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Foreword 



rd , 



This Technical Specification has been produced by the 3 Generation Partnership Project (3GPP). 

The contents of the present document are subject to continuing work within the TSG and may change following formal 
TSG approval. Should the TSG modify the contents of the present document, it will be re-released by the TSG with an 
identifying change of release date and an increase in version number as follows: 

Version x.y.z 

where: 

X the first digit: 

1 presented to TSG for information; 

2 presented to TSG for approval; 

3 or greater indicates TSG approved document under change control. 

y the second digit is incremented for all changes of substance, i.e. technical enhancements, corrections, 
updates, etc. 

z the third digit is incremented when editorial only changes have been incorporated in the document. 
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Scope 



The present document defines the Logical Link Control (LLC) layer protocol to be used for packet data transfer 
between the Mobile Station (MS) and Serving GPRS Support Node (SGSN). 

It defines the frame structure, elements of procedure, format of fields, and procedures for the proper operation of the 
logical link control layer. It is based on ideas contained in IS-130 [21], ISO 3309 [16], ISO 4335 [17], and 
ISO 7809 [18, 19, 20] (HDLC of ISO), as well ITU-T Q.920 [13] and Q.921 [14] (LAPD). The concepts, the overview 
description of LLC layer functions and procedures, and the relationship with other Technical Specifications are 
described in general terms in 3GPP TS 23.060 [5]. 

LLC spans from the Mobile Station (MS) to the Serving GPRS Support Node (SGSN). LLC is intended for use with 
both acknowledged and unacknowledged data transfer. 

The frame formats defined for LLC are based on those defined for LAPD and RLP. However, there are important 
differences between LLC and other protocols, in particular with regard to frame delimitation methods and transparency 
mechanisms. These differences are necessary for independence from the radio path. 

The LLC procedures are modelled upon the concepts of HDLC as outlined in ISO 4335. Data sequence integrity 
between the data source and data sink is effected by means of a cyclic numbering scheme. An independent numbering 
scheme is used for each logical data link, as identified by the a data link connection identifier. LLC supports two modes 
of operation: 

Unacknowledged peer-to-peer operation: 

A logical link entity may initiate transmissions to a peer entity without prior establishment of a logical 
connection with the peer entity. LLC does not guarantee in-order delivery. LLC can detect errors in a 
received frame, and, depending on whether the frame is sent in protected mode or not, either discard or 
deliver the erroneous frame. No error recovery procedures are defined at the LLC layer. Higher-layer 
protocols can be used to provide reliability, if needed. This mode of operation is known as Asynchronous 
Disconnected Mode (ADM). 

Acknowledged peer-to-peer operation: 

A balanced data link involves two participating entities, and each entity assumes responsibility for the 
organisation of its data flow and for error recovery procedures associated with the transmissions that it 
originates. Each entity operates as both a data source and data sink in a balanced link, allowing information 
to flow in both directions. This mode of operation is known as Asynchronous Balanced Mode (ABM), and 
provides a reliable service with in-order delivery. 

The present document is organised as follows: 

An overview of the LLC layer functions is given in clause 4. 

The frame structure for peer-to-peer communication is given in clause 5. 

The elements of procedure and formats of fields are given in clause 6. 

The elements of layer-to-layer communication are contained in clause 7. 

The details of the peer-to-peer ABM procedures are given in clause 8. 

The details of LLC frame ciphering are given in annex A. 

The details of the TOM protocol layer are contained in annex B. 

An overview of the LLC layer states is provided in annex C. 
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Definitions and abbreviations 



3.1 Definitions 

For the purposes of the present document, the terms and definitions given in 3GPP TS 21.905 [1] and 
3GPP TS 22.060 [3] and the following apply: 

active LLE: an LLE which SAPI is assigned to a layer-3 entity. 

empty XID command: an XID command sent by the SGSN which does not contain parameters to negotiate. 

frame rejection condition: a condition that results from the receipt of an undefined or incorrect frame. 

inquiry process: a process performed in the peer receiver busy condition in which the LLE checks that the peer LLE is 
still in the own receiver busy condition. 

invalid frame condition: a condition that results from the receipt of an invalid frame. 

logical link connection: the logical connection between two LLE peers. A logical link connection is identified with a 
Data Link Connection Identifier (DLCI). A logical link connection is always in one of three states: TLLI Unassigned, 
TLLI Assigned / ADM, or ABM. 

logical link control layer: the protocol layer between an MS and an SGSN consisting of one or more logical link 
management entities, one or more logical link entities, and a multiplex procedure. 

logical link entity: the LLC layer protocol state machine controlling one logical link connection. 

own receiver busy condition: a condition that results from the inability to accept additional I frames from the peer 
logical link entity. 

peer receiver busy condition: a condition that results from the reception in of a RNR frame from the peer logical link 
entity. 
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For the purposes of the present document, the following terms and definitions given in 3GPP TS 23.251 [5a] apply: 
Multi-Operator Core Network 



3.2 



Abbreviations 



For the purposes of the present document, the abbreviations given in 3GPP TS 21.905 [1] and 3GPP TS 23.060 [5], and 
the following apply: 

ABM Asynchronous Balanced Mode 

ACK ACKnowledgement 

ADM Asynchronous Disconnected Mode 

CNF CoNFirm 

DISC Disconnect 

DM Disconnected Mode 

FRMR FRaMe Reject 

GMM GPRS Mobility Management 

GRR GPRS Radio Resources service access point 

I Information 

IND INDication 

lOV Input Offset Value 

Kc 64-bit ciphering key 

Kci28 128-bit ciphering key 

LAPD Link Access Procedure on the D-channel 

LCS Location Services 

LL Logical Link 

LLC Logical Link Control 

LLE Logical Link Entity 

LLGMM LLC to GPRS Mobility Management service access point 

LLM Logical Link Management 

LLME Logical Link Management Entity 

MOCN Multi-Operator Core Network 

REQ REQuest 

RES RESponse 

RNR Receive Not Ready 

RR Receive Ready 

RRLP Radio Resource LCS Protocol 

S Supervisory 

SABM Set Asynchronous Balanced Mode 

SACK Selective ACKnowledgement 

TIA Telecommunications Industry Association 

TOM Tunnelling Of Messages 

UA Unnumbered Acknowledgement 

UI Unconfirmed Information 

XID exchange IDentification 



4 Overview description of LLC functions and 

procedures 

The requirements of the LLC layer can be summarised as follows: 

LLC shall provide a highly reliable logical link between the MS and the SGSN. 

LLC shall be independent of the underlying radio interface protocols in order to allow introduction of alternative 
GPRS radio solutions with minimal change to the NSS. 

LLC shall support variable-length information frames. 

LLC shall support peer-to-peer data transfers. 
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LLC shall support both acknowledged and unacknowledged data transfers. 

LLC shall permit information transfer between the SGSN and one or more MSs using the same physical 
(e.g. radio) resources. Thus each LLC frame shall uniquely identify the MS sending (uplink) or receiving 
(downlink) the information. 

LLC shall allow information transfer with different service criteria, such that high-priority data transfers may 
take precedence over lower -priority transfers to the same MS. 

LLC shall provide user data confidentiality by means of a ciphering function. 

LLC shall support user identity confidentiality. 



4.1 



Reference model 



A model of layering the protocols in GPRS is illustrated in figure 1 . 
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Figure 1 : Protocol layering in GPRS 

The LLC layer operates above the RLC and BSSGP layers in the reference architecture to provide logical links between 
an MS and its SGSN. 

Above the LLC layer is located the SubNetwork Dependent Convergence (SNDC) layer, that controls the transfer of 
user data network layer PDUs (N-PDUs) between the MS and SGSN. The SNDC functionaUty is described in 3GPP 
TS 23.060 [5] and specified in 3GPP TS 44.065 [11]. 

The logical link control layer Service Access Points (SAPs) are the points at which the LLC layer provides services to 
the layer-3 protocols in figure 1 . In addition to the SNDC protocol, LLC provides service to the GPRS Mobility 
Management (GMM) protocol, to the SMS protocol, and to the Tunnelling of Messages (TOM) protocol. 

An LLC layer connection is identified by the DLCI consisting of the SAP Identifier (SAPI) and the MS's Temporary 
Logical Link Identifier (TLLI). 

Each LLC frame consists of the header, trailer, and information field. The header and trailer fields contain information 
such as SAPI, frame number and checksum, that are used to identify the frame and to provide reliable transmission. The 
information field is variable length. Both transmission and retransmission of each frame are controlled by the LLC 
layer. 

Many of the formats and procedures are similar to the reference protocols, and differences are introduced only where 
needed to reflect the unique aspects of the GPRS architecture and requirements. 

4.2 General description of the LLC protocol 

LLC is considered to be a sublayer of layer 2 in the ISO 7-layer model. The purpose of LLC is to convey information 
between layer-3 entities in the MS and SGSN. Specifically, LLC shall support: 

multiple MSs at the Um interface; 



£75/ 



3GPP TS 44.064 version 10.1.0 Release 10 13 ETSI TS 1 44 064 VI 0.1 .0 (201 2-01 ) 

multiple layer-3 entities within an MS. 

LLC includes functions for: 

the provision of one or more logical link connections discriminated between by means of a DLCI; 

sequence control, to maintain the sequential order of frames across a logical link connection; 

detection of transmission, format and operational errors on a logical link connection; 

recovery from detected transmission, format, and operational errors; 

notification of unrecoverable errors; 

flow control; and 

ciphering. 

LLC layer functions provide the means for information transfer via peer-to-peer logical link connections between an 
MS and SGSN pair. 

4.2.1 Services required by tine lower layers 

LLC requires the following services from the layers below: 

LLC PDU delimitation to allow the LLC layer to determine the first octet and the last octet in each LLC PDU; 
and 

- transport of the MS address (a TLLI) of each LLC PDU between the MS and the SGSN. 

To "transmit a frame" and "send a frame" refers to the delivery of a frame by the LLC layer to the layer below. 



4.3 Unacknowledged operation 



With this type of operation, layer-3 information is transmitted in numbered Unconfirmed Information (UI) frames. The 
UI frames are not acknowledged at the LLC layer. Neither error recovery nor reordering mechanisms are defined, but 
transmission and format errors are detected. Duplicate UI frames are discarded. 

Flow control procedures are not defined. 

Two modes of unacknowledged operation are defined: 

protected mode in which the FCS field protects the frame header and information field; and 

unprotected mode in which the FCS field protects the frame header and only the first octets of the information 
field. 

Unacknowledged operation is allowed for all SAPIs that are not reserved (see table 2). 



4.4 Acknowledged operation 



With this type of operation, layer-3 information is transmitted in order in numbered Information (I) frames. The 
I frames are acknowledged at the LLC layer. Error recovery and reordering procedures based on retransmission of 
unacknowledged I frames are specified. Several I frames may be unacknowledged at the same time. In the case of errors 
that cannot be corrected by the logical link control layer, a report to GPRS mobility management shall be made. 

Flow control procedures are defined. 

Acknowledged operation requires that ABM operation has been initiated by an establishment procedure using the Set 
Asynchronous Balanced Mode (SABM) command. 

Acknowledged operation is allowed for all SAPIs that are not reserved (see table 2) except SAPIs 1, 2, 7, and 8. 
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4.5 Establishment of information transfer modes 

4.5.1 Data link connection identification 

A logical link connection is identified by a DLCI consisting of two identifiers: a S API and a TLLI. 

The SAPI is used to identify the service access point on the SGSN side and the MS side of the LLC interface. SAPI is 
carried in the address field of each LLC frame. 

The TLLI is used to identify a specific MS. TLLI assignment is controlled by GMM. TLLI is not carried in LLC 
frames, but in BSSGP messages as defined in 3GPP TS 48.018 [12], and in RLC/MAC blocks as defined in 
3GPPTS 44.018 [8]. 

4.5.2 Logical link states 

A logical link entity may be in one of three basic states: 

TLLI Unassigned state: information transfer shall not be possible with the following exception: the SGSN shall 
be able to receive UI and XID frames for SAPI = 1 ; 

TLLI Assigned / ADM state: in this state a TLLI has been assigned. Unacknowledged information transfer and 
XID negotiation shall be possible on SAPIs that are assigned to a layer-3 entity; or 

ABM state: this state shall be established by means of an ABM establishment procedure. Both acknowledged 
and unacknowledged information transfer shall be possible. 

The basic states and additional states are shown in annex C. 

4.5.3 TLLI assignment 

TLLI assignment is controlled by GMM. TLLIs are assigned, changed, and unassigned with the LLGMM-ASSIGN- 
REQ primitive, as described in subclause 7.2.1.1. 

4.5.4 Establishment of ABM operation 

Before peer-to-peer acknowledged information transfer can start, an exchange of a SABM frame and an Unnumbered 
Acknowledgement (UA) frame shall take place. The ABM establishment procedure is specified in clause 8. 

4.6 Data confidentiality 

The LLC layer shall provide data confidentiality by ciphering the information and PCS fields of data frames: 

The information and PCS fields of I frames shall be ciphered whenever ciphering information has been assigned 
to the TLLI. 

The information and PCS fields of UI frames shall be ciphered whenever layer 3 indicates that the UI frame shall 
be ciphered and ciphering information has been assigned to the TLLI. 
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4.7 LLC layer structure 



The LLC layer structure is shown in figure 2. This figure is a model shown for illustrative purposes only, and does not 
constrain implementations. 
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Figure 2: Functional model of the LLC layer 



4.7.1 Logical Link Entity 



The logical link procedures consist of multiple Logical Link Entities (LLEs) that control the information flow of 
individual connections. There may be multiple LLEs per TLLI. Functions provided by each LLE are: 

unacknowledged information transfer; 

acknowledged information transfer; 

flow control in ABM operation; and 

frame error detection. 

The LLE analyses the control field of the received frame (see subclause 6.3) and provides appropriate responses and 
layer-to-layer indications. In addition, LLE analyses the LLC layer service primitives and transmits the appropriate 
command and response frames. There is one logical link entity for each DLCI. 
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4.7.2 Multiplex procedure 

On frame transmission, the multiplex procedure generates and inserts the FCS, performs the frame ciphering function, 
and provides SAPI-based logical link control layer contention resolution between the various LLEs. 

On frame reception, the multiplex procedure performs the frame decipher function and checks the FCS. If the frame 
passes the FCS check, the multiplex procedure distributes the frame to the appropriate logical link entity based on the 
DLCI. 

3GPP TS 41.061 [2] contains the requirements for the GPRS ciphering algorithm. 



4.7.3 Logical Link Management 



The Logical Link Management Entity (LLME) manages the resources that have an impact on individual connections. 
There is one LLME per TLLI. Functions provided by the LLME are: 

parameter initialisation; 

error processing; and 

connection flow control invocation. 

The RLC/MAC layer functions are described in 3GPP TS 43.064 [6]. BSSGP is specified in 3GPP TS 48.018 [12]. 
SNDCP is specified in 3GPP TS 44.065 [11]. 



4.8 GPRS Mobility Management 



GPRS Mobility Management (GMM) uses the services of the LLC layer to transfer messages between the MS and the 
SGSN. GMM includes functions such as attach and authentication, and transport of session management messages for 
functions such as PDP context activation and deactivation. GMM procedures are defined in 3GPP TS 24.008 [8a] and 
are beyond the scope of the LLC layer. Interaction between GMM and LLC is defined in terms of service primitives, 
see clause 7. 



4.9 Short Message Service 



The Short Message Service (SMS) uses the services of the LLC layer to transfer short messages between the MS and 
the SGSN. SMS procedures are defined in 3GPP TS 23.040 [4] and 3GPP TS 24.01 1 [9] and are beyond of the scope of 
the LLC layer. Interaction between SMS and LLC is defined in terms of service primitives, see clause 7. 



4.10 Tunnelling Of Messages 



TOM is a generic protocol layer used for the exchange of TOM Protocol Envelopes between the MS and the SGSN. 
TOM procedures are defined in annex B. 



5 Frame structure 

5.1 General 

All logical link control layer peer-to-peer exchanges shall be in frames conforming to the format shown in figure 3. The 
frame header shall consist of the address and control fields, and is a minimum of 2 octets and a maximum of 37 octets 
long. 
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Address Field (1 octet) 



Control Field 
(variable length, max. 36 octets) 



Information Field 
(variable length, max. N201 octets) 



Frame Check Sequence Field 



(3 octets) 



Figure 3: LLC frame format 



5.2 



Address field 



The address field consists of a single octet. The address field contains the S API and identifies the DLCI for which a 
downlink frame is intended and the DLCI transmitting an uplink frame. The format of the address field is defined in 
subclause 6.2. 

5.3 Control field 

The control field typically consists of between one and three octets. The SACK supervisory frame also includes a 
variable-length bitmap field of up to 32 octets. The format of the control field is defined in subclause 6.3. 



5.4 



Information field 



The information field of a frame, when present, follows the control field (see subclause 5.4). The maximum number of 
octets in the information field (N201) is defined in subclause 8.9.5. 

5.5 Frame Check Sequence (FCS) field 

The FCS field shall consist of a 24 bit cyclic redundancy check (CRC) code. The CRC-24 is used to detect bit errors in 
the frame header and information fields. 

The FCS field contains the value of a CRC calculation that is performed over the entire contents of the header and 
information field, except for UI frames transmitted in unprotected mode, in which case the FCS field contains the value 
of a CRC calculation that is performed over the frame header and the first N202 octets (see subclause 8.9.6) of the 
information field only (see subclause 6.3.5.5.2). The information over which the CRC is calculated is referred to as the 
dividend in this subclause. Bit (1, 1) of the dividend is the highest-order term in the calculation (see subclause 5.7.3). 
CRC calculation shall be done before ciphering at the transmitting side, and after deciphering at the receiving side. 

NOTE: The definition below is different from that in 3GPP TS 24.022 [10] only with respect to the variable 

dividend length k of the LLC frames. In 3GPP TS 24.022, the RLP frame has a fixed dividend length, but 
the LLC frame has a variable dividend length. 

The CRC shall be the ones complement of the sum (modulo 2) of: 

the remainder of x'' (x^^ H- x^^ H- x^' H-. . . +\^ + \+ 1) divided (modulo 2) by the generator polynomial, where k is 
the number of bits of the dividend; and 

the remainder of the division (modulo 2) by the generator polynomial of the product of x'" by the dividend. 
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The CRC-24 generator polynomial is: 

G(x) = x^^ + x^Vx^' + x^" + x" + x'^ + x'^ + x'^ + x'Vx^ + x^ + x' + xSx^+l 

The result of the CRC calculation is placed within the FCS field as described in subclause 5.7.3. 

NOTE: As a typical implementation at the transmitter, the initial content of the register of the device computing 
the remainder of the division is pre-set to all " I's" and is then modified by division by the generator 
polynomial (as described above) of the dividend; the ones complement of the resulting remainder is put 
into the FCS field. 

As a typical implementation at the receiver, the initial content of the register of the device computing the remainder of 
the division is pre-set to all "I's". The final remainder, after multiplication by x^" and then division (modulo 2) by the 
generator polynomial of the received frame, will be (in the absence of errors): 

C(x) = x^^ + x^' + x" + x'^ + x"> + x'^ + x" + x** + x^ + x^ 

5.6 Transparency 

5.6.1 Bit transparency 

Because of the frame delimitation technique used in LLC, the frame can include any possible sequence of bits without 
the need for e.g., bit stuffing as defined in ITU-T Recommendation Q.921 [14]. 

5.6.2 Information protection 

The information carried within a UI frame may be considered as either "protected" or "unprotected" (see 

subclause 6.3.5.5.2). CRC error detection procedures are only used on the first octets of the information content within 

unprotected UI frames, supporting applications that can tolerate bit errors. 



5.6.3 Octet alignment 



LLC provides only an octet-aligned service to layer 3. LLC requires that information exchanged with layer 3 contains 
an integral number of octets. 



5.7 



Format convention 



5.7.1 



Numbering convention 



The basic convention used in the present document is illustrated in figure 4. The bits are grouped into octets. The bits of 
an octet are shown horizontally and are numbered from 1 to 8. Multiple octets are shown vertically and are numbered 
from 1 to n. 



Bit 

5 4 



1 Octet 
1 

2 



n-1 



Figure 4: Format convention 
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5.7.2 Order of transmission 

Frames are transferred between the LLC layer and underlying protocol layers in units of octets, in ascending numerical 
octet order (i.e., octet 1, 2, ..., n-1, n). The order of bit transmission is specific to the underlying protocols used across 
the Um interface (e.g., RLC) and the Gb interface (BSSGP). 

5.7.3 Field mapping convention 

When a field is contained within a single octet, the lowest bit number of the field represents the lowest-order value. 
When a field spans more than one octet, the order of bit values within each octet progressively decreases as the octet 
number increases. In that part of the field contained in a given octet the lowest bit number represents the lowest-order 
value. 

For example, a bit number can be identified as a couple (o, b) where o is the octet number and b is the relative bit 
number within the octet. Figure 5 illustrates a field that spans from bit (1, 3) to bit (2, 7). The high-order bit of the field 
is mapped on bit (1, 3) and the low-order bit is mapped on bit (2, 7). 



1 St octet of field 
2nd octet of field 



Figure 5: Field mapping convention 

An exception to the preceding field mapping convention is the FCS field. In this case bit 1 of the first octet is the high- 
order bit and bit 8 of the last octet is the low-order bit. The field mapping for a 24 bit FCS is shown in figure 5. 

Bit 
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216 




223 


28 




2l5 
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Figure 6: FCS mapping convention 



5.8 



Invalid frames 



An invalid frame is a frame that: 

contains fewer octets than necessary to include the address field, control field, information field, and FCS field 
necessary to constitute a complete frame according to the contents of the control field; 

- has the PD bit set to 1; 

contains a reserved SAPI or a SAPI that is not supported or not assigned to a layer-3 entity; or 

contains an FCS error. 

An invalid frame shall be discarded without notification to the sender. No action shall be taken as the result of that 
frame. 



Elements of procedures and formats of fields 



6.1 



General 



The elements of procedures define the commands and responses that are used on the logical link connections between 
the MS and SGSN. 
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Procedures are derived from these elements of procedures and are described in clause 8. 

If a bit position is marked as "spare", it shall be coded as 0. A spare bit is indicated with an 'X' in the format figures in 
this clause. For future compatibility reasons, an entity receiving frames, where spare bit positions are coded otherwise, 
shall ignore those values without notification of any error. 

6.2 Address field format and variables 

The address field consists of 

the Protocol Discriminator bit PD; 

the Command/Response bit C/R; and 
- the SAPI. 
The format of the address field is shown in figure 7. 



Bit 

5 4 3 2 



PD 


C/R 


X 


X 


SAPI 



1 Octet 
1 



Figure 7: Address field format 



6.2.1 Protocol Discriminator bit (PD) 



The PD bit indicates whether a frame is an LLC frame or belongs to a different protocol. LLC frames shall have the 
PD bit set to 0. If a frame with the PD bit set to 1 is received, then it shall be treated as an invalid frame, see 
subclause 5.8. 



6.2.2 Command/Response bit (C/R) 



The C/R bit identifies a frame as either a command or a response. The MS side shall send commands with the C/R bit 
set to 0, and responses with the C/R bit set to 1. The SGSN side shall do the opposite; i.e., commands are sent with C/R 
set to 1, and responses are sent with C/R set to 0. The combinations for the SGSN side and MS side are shown in 
table 1. 

Table 1 : C/R field bit usage 



Type 


Direction 


C/R value 


Command 


SGSN side to MS side 


1 


Command 


MS side to SGSN side 





Response 


SGSN side to MS side 





Response 


MS side to SGSN side 


1 



6.2.3 Service Access Point Identifier (SAPI) 

SAPI identifies a point at which LLC services are provided by an LLE to a layer-3 entity. Consequently, SAPI identifies 
an LLE that should process an LLC frame and also a layer-3 entity that is to receive information carried by the LLC 
frame. 
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SAPI allows 16 service access points to be specified. The SAPI values are allocated as shown in table 2. 

Table 2: Allocation of SAPI values 



SAPI 


Related Service 


SAP Name 


0000 


Reserved 


- 


0001 


GPRS Mobility IVIanagement 


LLGMM 


0010 


Tunnelling of messages 2 


T0M2 


0011 


User data 3 


LL3 


0100 


Reserved 


- 


0101 


User data 5 


LL5 


0110 


Reserved 


- 


0111 


SMS 


LLSMS 


1000 


Tunnelling of messages 8 


TOMS 


1001 


User data 9 


LL9 


1010 


Reserved 


- 


1011 


User data 1 1 


LL11 


1100 


Reserved 


- 


1101 


Reserved 


- 


1110 


Reserved 


- 


1111 


Reserved 


- 



6.3 Control field formats, parameters, and variables 

The control field identifies the type of frame. Four types of control field formats are specified: 
confirmed information transfer (I format); 
supervisory functions (S format); 
unconfirmed information transfer (UI format); and 
control functions (U format). 
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The control field formats for LLC are shown in figure 8 and figure 9. For definition of values for supervisory function 
bits and unnumbered function bits, see table 4. 



Control Field Bits 



Format 
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I format 
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X 


N(S) 


(I+S) 


N(S) 


X 


N(R) 




N(R) 


Si 


S2 


S format 


1 





A 


X 


X 


N(R) 




N(R) 


s, 


S2 


UI format 


1 


1 





X 


X 


N(U) 




N(U) 


E 


PM 


U format 


1 


1 


1 


P/F 


M4 


M3 


M2 


Ml 



Octet 
1 

2 
3 
1 
2 
1 
2 
1 



A Acknowledgement request bit 

E Encryption function bit 

M„ Unnumbered function bit 

N(R) Transmitter receive sequence number 

N(S) Transmitter send sequence number 

N(U) Transmitter unconfirmed sequence number 

P/F Poll bit, when issued as a command. 
Final bit, when issued as a response 

PM Protected mode bit 

Sn Supervisory function bit 

X Spare bit 

Figure 8: Control field format 
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R(250) 


R(251) 


R(252) 
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X 


36 (max) 
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S frame 
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4 
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R(250) 


R(251) 


R(252) 


R(253) 


R(254) 


R(255) 


X 


34 (max) 



K Bitmap length indicator. 

R(n) Bitmap bit. 

Figure 9: SACK I and S frame control field format 
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6.3.1 Information transfer format - 1 

The I format shall be used to perform an information transfer between layer-3 entities. The functions of N(S), N(R), and 
A are independent; that is, each I frame has an N(S) sequence number, an N(R) sequence number that may or may not 
acknowledge additional I frames received by the LLE, and an A bit that may be set to or 1 . The use of N(S), N(R), 
and A is defined in clause 8. 

Each I frame also contains supervisory information, in effect "piggy-backing" an S frame with each I frame, so that it 
may be considered to be an I+S frame. 

6.3.2 Supervisory format - S 

The S format shall be used to perform logical link supervisory control functions such as acknowledge I frames and 
request a temporary suspension of I-frame transmission. The functions of N(R) and the A bit are independent; that is, 
each supervisory frame has an N(R) sequence number that may or may not acknowledge additional I frames received by 
the LLE, and an A bit that may be set to or L The use of N(R) and the A bit is described in clause 8. 

6.3.3 Unconfirmed Information format - Ul 

The UI format shall be used to perform an information transfer between layer-3 entities without acknowledgement. No 
verification of sequence numbers is performed for UI frames. Therefore, a UI frame may be lost without notification to 
the layer-3 entity if a logical link exception occurs during transmission of the frame. The information field may be 
encrypted or not as indicated by the E bit (see subclause 6.3.5.5.1). The frame also includes an PM bit that allows the 
transfer of unprotected information (see subclause 6.3.5.5.2). 

6.3.4 Unnumbered format - U 

The U format shall be used to provide additional logical link control functions. This format contains no sequence 
number. The format includes a P/F bit that may be set to or 1 . 

6.3.5 Control field parameters and associated state variables 

The various parameters associated with the control field formats are described in this subclause. 

6.3.5.1 Poll/Final bit (P/F) 

All U frames contain the Poll/Final (P/F) bit. The P/F bit serves a function in both command frames and response 
frames. In command frames the P/F bit is referred to as the P bit. In response frames it is referred to as the F bit. 

The P bit set to 1 is used by an LLE to solicit (poll) a response frame from the peer LLE. The F bit set to 1 is used by an 
LLE to indicate the response frame transmitted as a result of a soliciting (poll) command. 

The use of the P/F bit is described in clause 8. 

6.3.5.2 Acknowledgement request bit (A) 

All I and S frames contain the Acknowledgement Request (A) bit. 

The A bit set to 1 is used by an LLE to solicit an acknowledgement (i.e., an l+S or S frame) from the peer LLE. The 
A bit set to is used by an LLE to indicate that the peer LLE is not requested to send an acknowledgement. 

The use of the A bit is described in clause 8. 
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6.3.5.3 Modulus 

Each I and UI frame is sequentially numbered by a sequence number that may have the value through 511. 

Arithmetic acting on parameters and variables that are related to such sequence numbers operates modulo 512 
(i.e. N(S), N(R), N(U), V(S), V(R), V(A), V(U), V(UR); see the following subclauses). 

NOTE: Modulo 512 operation on negative numbers is performed by adding multiples of 5 12 to the negative 
number until the result becomes non-negative. Then common modulo 512 operation is applied. 

6.3.5.4 ABM variables and sequence numbers 

6.3.5.4.1 Send state variable V(S) 

In Asynchronous Balanced Mode, each LLE peer shall have an associated send state variable V(S) when using I frames. 
V(S) denotes the sequence number of the next in-sequence I frame to be transmitted. V(S) can take on the value 
through 511. The value of V(S) shall be incremented by 1 with each successive I frame transmission, and shall not 
exceed V(A) by more than the maximum number of outstanding I frames k. The value of k may be in the range 
1 < k < 255, as defined in subclause 8.9.8. V(S) shall not be incremented when an I frame is retransmitted. 

6.3.5.4.2 Acknowledge state variable V(A) 

In Asynchronous Balanced Mode, each LLE peer shall have an associated acknowledge state variable V(A) when using 
I frame and supervisory frame commands and responses. V(A) identifies the first I frame in the transmit window, so 
that V(A) - 1 equals N(S) of the last in-sequence acknowledged I frame. V(A) can take on the value through 511. The 
value of V(A) shall be updated by the valid N(R) values received from its peer (see subclause 6.3.5.4.5). A valid N(R) 
value is one that is in the range V(A) < N(R) < V(S). 

These inequalities shall be interpreted in the following way: 

N(R) is valid if, and only if, ( N(R) - V(A) ) mod 512 < ( V(S) - V(A) ) mod 512. 

Furthermore, from subclause 6.3.5.4.1, ( V(S) - V(A) ) mod 512 < k. 

6.3.5.4.3 Send sequence number N(S) 

In Asynchronous Balanced Mode, only I frames contain N(S), the send sequence number of transmitted I frames. At the 
time that an in-sequence I frame is designated for transmission, the value of N(S) is set equal to the value of the send 
state variable V(S). 

6.3.5.4.4 Receive state variable V(R) 

In Asynchronous Balanced Mode, each LLE peer shall have an associated receive state variable V(R) when using 
I frame and supervisory frame commands and responses. V(R) denotes the sequence number of the next in-sequence 
I frame expected to be received. V(R) can take on the value through 511. The value of V(R) shall be incremented by 
one with the receipt of an error-free, in-sequence I frame whose send sequence number N(S) equals V(R). 

6.3.5.4.5 Receive sequence number N(R) 

In Asynchronous Balanced Mode, all I frames and supervisory frames contain N(R), the expected send sequence 
number of the next in-sequence received I frame. At the time that a frame of the above types is designated for 
transmission, the value of N(R) is set equal to the value of the receive state variable V(R). N(R) indicates that the LLE 
transmitting the N(R) has correctly received all I frames numbered up to and including N(R) - 1 . 
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6.3.5.4.6 



SACK bitmap R(n) 



In Asynchronous Balanced Mode, all I+S and S SACK frames contain R(n), the SACK bitmap. At the time that a 
SACK frame is designated for transmission, the value of each bit R(n) in the bitmap shall be set to or 1 depending on 
whether I frame number N(R) + n has been received or not. R(n) = 1 indicates that the LLE transmitting the SACK 
frame has correctly received I frame number N(R) + n. R(n) = indicates that the LLE transmitting the SACK frame 
has not correctly received I frame number N(R) + n. 

The SACK bitmap contains a maximum of 255 bits, or 32 octets, as shown in figure 9. The bitmap shall be truncated so 
that only bitmap octets up to and including the last bitmap octet containing at least one bit set to 1 are transmitted. The 
trailing bitmap octets shall not be transmitted. 

The I+S SACK frame contains a bitmap length indicator K. K + 1 indicates the number of octets in the bitmap. K can 
take any value through 3 1 . 



6.3.5.4.7 



I frame buffer variable B 



In Asynchronous Balanced Mode, each LLE peer shall have an associated I frame buffer variable B when using I frame 
and supervisory frame commands and responses. The value of B has a range of < B < M, where M is defined in 
subclause 8.9.7. 

Function L(x) gives the total information field length in octets of the I frame with sequence number x. B shall be 
incremented with L(x) of each transmitted I frame as defined in subclause 8.6.1. B shall be decremented by L(x) of each 
acknowledged I frame as defined in subclause 8.6.3.2. 

6.3.5.4.8 Other parameters and variables 

For definition and values of additional parameters and variables, see subclause 8.9. 



6.3.5.5 



Unacknowledged operation variables and parameters 



6.3.5.5.1 



Encryption mode bit (E) 



The E bit is used to indicate whether the information and FCS fields of the UI frame are encrypted (ciphered) to provide 
user data confidentiality. The E bit is set to 1 to indicate an encrypted frame. The E bit is set to to indicate a frame 
sent without encryption. 



6.3.5.5.2 



Protected Mode bit (PM) 



The PM bit is used to indicate whether the FCS field shall be calculated using both the frame header and information 
fields. 

The PM bit is set to 1 to indicate that the FCS covers the frame header and information fields. 

The PM bit is set to to indicate that the FCS covers only the frame header field and the first N202 octets of the 
information field. If the length of the information field is less than N202 octets then the FCS shall cover the complete 
information field. This permits UI frames to transport "unprotected" information, such that errors beyond the first N202 
octets of the information field do not result in the frame being discarded. 

Table 3: UI frame content 



PM 


E 


UI frame information field 








unprotected, non-ciphered information 





1 


unprotected, cipliered information 


1 





protected, non-ciphered information 


1 


1 


protected, ciphered information 
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6.3.5.5.3 



Unconfirmed send state variable V(U) 



Each LLE peer shall have an associated unconfirmed send state variable V(U) when using UI frame commands. V(U) 
denotes the sequence number of the next UI frame to be transmitted. V(U) can take on the value through 511. The 
value of V(U) shall be incremented by 1 with each successive UI frame transmission. 



6.3.5.5.4 



Unconfirmed sequence number N(U) 



Only UI frames contain N(U), the unconfirmed sequence number of transmitted UI frames. At the time that a UI frame 
is designated for transmission, the value of N(U) is set equal to the value of the unconfirmed send state variable V(U). 



6.3.5.5.5 



Unconfirmed receive state variable V(UR) 



Each LLE peer shall have an associated unconfirmed receive state variable V(UR) when using UI frame commands. 
V(UR) denotes the sequence number of the next in-sequence UI frame expected to be received. V(UR) can take on the 
value through 511. 



6.3.5.5.6 



Other parameters and variables 



The only other parameter defined for unacknowledged operation is the number of octets (N201-U) in the information 
field of the UI frame. See subclause 8.9.4. 



6.4 Commands and responses 



The following commands and responses are used by the MS and the SGSN LLEs and are represented in table 4. Each 
logical link connection shall support the appropriate set of commands and responses for the type of operation desired 
(see clause 8). 

Those frame types not identified in figure 8, figure 9, or table 4, shall be identified as having undefined command 
and/or response control fields, and shall be treated as defined in subclause 8.8.2. 

Table 4: Commands and responses 



Format 


Commands 


Responses 


Encoding 


SI 


S2 


M4 


M3 


M2 


Ml 


Supervisory 


RR 


RR 








- 


- 


- 


- 


Supervisory 


ACK 


ACK 





1 


- 


- 


- 


- 


Supervisory 


RNR 


RNR 


1 





- 


- 


- 


- 


Supervisory 

or 
Information + 
Supervisory 


SACK 


SACK 


1 


1 










Unnumbered 


- 


DM 


- 


- 











1 


Unnumbered 


DISC 


- 


- 


- 





1 








Unnumbered 


- 


UA 


- 


- 





1 


1 





Unnumbered 


SABM 


- 


- 


- 





1 


1 


1 


Unnumbered 


- 


FRMR 


- 


- 


1 











Unnumbered 


XID 


XID 


- 


- 


1 





1 


1 


Unnumbered 


NULL 


- 


- 


- 















The commands and responses in table 4 are defined in the following subclauses. 

6.4.1 Unnumbered (U) frames 

6.4.1 .1 Set Asynchronous Balanced Mode (SABM) command 

The SABM unnumbered command shall be used to place the addressed MS or SGSN side into ABM acknowledged 
operation. 
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An LLE shall confirm acceptance of a S ABM command by the transmission at the first opportunity of a UA response. 
Upon acceptance of this command, the LLE's send state variable V(S), acknowledge state variable V(A), and receive 
state variable V(R), shall be set to 0. The transmission of a S ABM command indicates the clearance of any exception 
condition, and a busy condition that was reported by the earlier transmission of an RNR frame by that same LLE. 

Previously transmitted I frames that are unacknowledged when this command is actioned shall be discarded. It is the 
responsibility of a higher layer to recover from the possible loss of the contents of such 1 frames. 

An information field is permitted with the S ABM command. If included, the information field shall contain XID 
parameters. This allows the LLC peers to negotiate LLC layer parameters and layer-3 parameters with the SABM 
command and UA response, using the procedure (but not the XID frames) defined in subclauses 6.4. L6 and 8.5.3. 

6.4.1 .2 Disconnect (DISC) command 

The DISC unnumbered command shall be transmitted in order to terminate the ABM operation. 

No information field is permitted with the DISC command. Prior to executing the command, the LLE receiving the 
DISC command shall confirm the acceptance of a DISC command by the transmission of a UA response. The LLE 
sending the DISC command shall terminate the ABM operation when it receives the acknowledging UA or DM 
response. 

Previously transmitted I frames that are unacknowledged when this command is executed shall remain unacknowledged 
and shall be discarded. It is the responsibility of a higher layer to recover from the possible loss of the contents of such 
I frames. 

6.4.1 .3 Unnumbered Acknowledgement (UA) response 

The UA unnumbered response shall be used by an LLE to acknowledge the receipt and acceptance of the mode-setting 
commands (SABM or DISC). Received mode-setting commands are not actioned until the UA response is transmitted. 

An information field is only permitted when UA is the response to a SABM command. The UA response shall in this 
case contain XID parameters with negotiated XID values, using the procedure (but not the XID frames) defined in 
subclauses 6.4. L6 and 8.5.3. 

The transmission of the UA response indicates the clearance of any busy condition that was reported by the earlier 
transmission of an RNR frame by that same LLE. 

6.4.1 .4 Disconnected Mode (DM) response 

The DM unnumbered response shall be used by an LLE to report to its peer that the LLE is in a state such that ABM 
operation cannot be performed. An LLE shall transmit a DM response to any valid command received that it cannot 
action. 

No information field is permitted with the DM response. 

6.4.1 .5 Frame Reject (FRMR) response 

The FRMR unnumbered response may be received by an LLE as a report of a frame rejection condition not recoverable 
by retransmission of the identical frame: 

1) receipt of a command or response control field that is undefined or not implemented (see subclause 6.4, 
2"'' paragraph); 

2) receipt of a supervisory or unnumbered frame with incorrect length; or 

3) receipt of an I frame with an information field that exceeds the maximum established length. 

An undefined control field is any of the control field encodings that are not identified in figure 8, figure 9, or table 4. 
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An information field that immediately follows the control field and that consists of 10 octets shall be returned with this 
response to provide the reason for the FRMR response. This information field format is given in figure 10. Only the 
first 6 octets of the control field of the rejected frame shall be sent. If the control field of the rejected frame is fewer than 
6 octets, then the unused octets shall be set to 0. 



Bit 



8 


7 


6 


5 


4 


3 


2 


1 


Rejected frame 
control field 


X 


X 


X 


X 


V(S) 


V(S) 


X 


V(R) 


V(R) 


C/R 


X 


X 


X 


X 


W4 


W3 


W2 


Wl 



Octet 
1 
2 
3 
4 
5 
6 
7 
8 
9 
10 



Figure 10: FRMR frame information field format 

The information fields defined for the FRMR response are listed in table 5. 

Table 5: FRMR frame fields 



Field 


Description 


Rejected frame control field 


The control field of the received frame that caused the frame reject. 


V(S) 


The current send state variable value of the LLE reporting the rejection condition. 


V(R) 


The current receive state variable value of the LLE reporting the rejection condition. 
V(R) shall not be treated as an acknowledgement of 1 frames. 


C/R 


Set to 1 if the frame rejected was a response and set to if the frame rejected was a 
command. 


W1 


Set to 1 to indicate that the control field received and returned in octets 1 and 2 was 
considered invalid because the frame contained an information field that is not 
permitted within this frame or is a supervisory or unnumbered frame with Incorrect 
length. Bit W3 shall be set to 1 in conjunction with this bit. 


W2 


Set to 1 to indicate that the information field received exceeded the maximum 
established information field length (N201) of the LLE reporting the rejection condition. 


W3 


Set to 1 to indicate that the control field received and returned in octets 1 and 2 was 
undefined or not implemented. 


W4 


Set to 1 to indicate that the LLE was in ABM when reporting the rejection condition. 



6.4.1.6 



Exchange Identification (XID) command/response 



This frame shall be used to negotiate and re-negotiate LLC layer parameters and layer-3 parameters. XID frames can be 
transmitted in ADM and ABM. 

The negotiation procedure is one-step, i.e., one side shall start the process by sending an XID command, offering a 
certain set of parameters from the applicable parameter repertoire (see table 6) the sending entity wants to negotiate, 
proposing values within the allowed range. In return, the other side shall send an XID response, either confirming these 
parameter values by returning the requested values, or offering higher or lower ones in their place. As an optimisation, 
parameters confirming the requested values may be omitted from the XID response. See table 6 for sense of negotiation. 
This shall end the negotiation process. 

Parameters that are not included in neither the XID command nor in the XID response, shall retain their current values. 
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The responding side may respond with parameters that were not included in the XID command. A parameter that was 
not included in the XID command shall in this case be treated as if the current value of the parameter was included in 
the XID command. The responding side shall include such a parameter in every XID response until the parameter has 
been explicitly negotiated, either by responding to an XID command that included the parameter, or by explicitly 
including the parameter the next time an XID command is transmitted. 

Both entities shall support the negotiated values, however under certain conditions one or more parameters may need to 
be re-negotiated (e.g., in the case of a change in SGSN). 

XID frames shall always be used with the P/F bit set to 1 . 

Without any prior XID exchange, default values shall apply. 

Negotiated XID parameters shall apply to the LLE identified by the DLCI of the XID frames used, except Version, 
Reset, and lOV-UI that applies to an LLME (i.e., a TLLI), and except Layer-3 Parameters that apply to the layer 3 
above the LLE. 

Table 6 lists the negotiable LLC layer parameters. Figure 1 1 shows the format of the XID parameter field. 



8 


7 


Bit 

6 5 4 


3 


2 


1 


XL 


Type 


Length 


Length 


X 


X 


High-order octet 




Low-order octet 



Octet 
1 

2 
2 or 3 



Figure 11 : XID parameter field format 

A parameter item consists of one or two type/length octets followed by the value of that parameter. The XID Length 
(XL) bit indicates whether the Length field is 2 bits or 8 bits long. If XL is set to 0, then Length consists of 2 bits and 
type/length occupies one octet. If XL is set to 1 then Length consists of 8 bits and type/length occupies two octets. The 
length indicator gives the number of octets that the value actually occupies. Length shall be set to the value in table 6 
for XID parameters that do not have a variable length. The parameter items can be arranged in arbitrary order. The 
parameter items shall begin in the first octet of the XID information field and follow on contiguously. 
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Table 6: LLC layer parameter negotiation 



Parameter Name 


Type 


Length 


Format 
(87654321) 


Range 


Units 


Sense of 
Negotiation 


Version (LLC version 
number) 





1 


OOOObbbb 


through 
15 


- 


down 


lOV-UI (ciphering Input 
offset value for Ul 
frames), common for all 
SAPIs of a TLLI 


1 


4 


bbbbbbbb 
bbbbbbbb 
bbbbbbbb 
bbbbbbbb 


through 

232.1 






lOV-l (ciphering Input 
offset value for 1 frames), 
fortheSAPI under 
negotiation 


2 


4 


bbbbbbbb 
bbbbbbbb 
bbbbbbbb 
bbbbbbbb 


through 

232.1 






T200 (retransmission 
time-out) 


3 


2 


OOOObbbb 
bbbbbbbb 


1 through 
4 095 


0,1 s 


up 


N200 (maximum number 
of retransmissions) 


4 


1 


OOOObbbb 


1 through 
15 


- 


up 


N201-U (maximum 
information field length 
for U and Ul frames) 


5 


2 


OOOOObbb 
bbbbbbbb 


140 

through 

1 520 


octets 


down 


N201-I (maximum 
information field length 
for 1 frames) 


6 


2 


OOOOObbb 
bbbbbbbb 


140 

through 

1 520 


octets 


down 


mD (1 frame buffer size in 
the downlink direction) 


7 


2 


Obbbbbbb 
bbbbbbbb 


0,9 
through 
24 320 


1 6 octets 


down 


mU (1 frame buffer size in 
the uplink direction) 


8 


2 


Obbbbbbb 
bbbbbbbb 


0,9 
through 
24 320 


1 6 octets 


down 


kD (window size in the 
downlink direction) 


9 


1 


bbbbbbbb 


1 through 
255 


frames 


down 


kU (window size in the 
uplink direction) 


10 


1 


bbbbbbbb 


1 through 
255 


frames 


down 


Layer-3 Parameters 


11 


Variable 


See 3GPPTS 44.065 [11] 


Reset 


12 





- - 


NOTE 1 : The Range for N201 -U for SAPI 1 is 400 through 1 520 octets, and for SAPIs 2, 7, and 8 270 through 

1 520 octets. 
NOTE 2: All other Types and Ranges are reserved for future versions of the present document. 
NOTE 3: The length for Layer-3 Parameters shall be set equal to the number of octets received from layer 3. If an 

empty XID block is received from layer 3, the LLE shall include a zero-length Layer-3 Parameters XID 

parameter in the XID parameter field to allow the receiving LLE to distinguish between LLC and layer-3 

initiated procedures. 



Version shall not be negotiated while in ABM. 

Reset shall only be negotiated with an XID frame, and only be transmitted in the downlink direction. If Reset is present 
in an XID frame, then it shall be the first XID parameter in the XID infc)rmation field. 

lOV-UI shall only be negotiated in ADM. lOV-I shall only be negotiated with SABM and UA frames. lOV-UI and 
lOV-I shall only be transmitted in the downlink direction. 

T200, N200, and N201-U can be negotiated in ADM and ABM. The new values of T200 shall only apply to timers set 
after the negotiation has been completed. If N201-U is negotiated to a lower value than previously used, then any 
queued or new U and Ul frames that violate the new value of N201-U should be discarded and not transmitted. 

U or Ul frames that violate the negotiated value of N201-U may be discarded by the receiver. 

If N201-U is negotiated to a lower value than previously used and the side originating the XID negotiation does not 
suspend the transfer of U and Ul frames for the respective SAPI during the negotiation, then it should apply the 
proposed value for N201-U already to the U and Ul frames transmitted during the negotiation. For received U and Ul 
frames the side originating the XID negotiation shall apply the previous value of N201-U until the negotiation is 
completed. 

N201-I, mD, mU, kD, and kU can be negotiated to any value in Range in ADM. In ABM, N201-I, mD, mU, kD, and 
kU can only be negotiated to the same or higher value as previously used. 
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6.4.1.7 



NULL command 



The NULL unnumbered command shall be used by an MS LLE to indicate a cell update. The NULL unnumbered 
command is only allowed if the Cell Notification is indicated by the SGSN (see 3GPP TS 23.060 [5] and 3GPP TS 
24.008 [8a]). 

No information field is permitted with the NULL command. 

6.4.2 Unconfirmed Information (Ul) frame 



6.4.2.1 



Unconfirmed Information (Ul) command 



When a layer-3 entity requests unacknowledged information transfer, the Ul command shall be used to send 
information to its peer. No verification of sequence numbers is performed for Ul frames. Therefore, the Ul frame may 
be lost without notification to the layer-3 entity if a logical link exception occurs during transmission of the command. 



6.4.2.2 



Unconfirmed Information (Ul) Dummy command 



The Ul Dummy command is a special Ul command that shall never be transmitted by an LLC entity, but it can be 
received by the LLC entity at the MS . 

If the LLC entity at the MS receives a Ul Dummy command, it shall discard it without any further actions. 

NOTE 1: The Ul Dummy command may be used by the network for different purposes which are specified in 
3GPP TS 44.060 [23] (e.g. to delay the release of a downlink TBF). 

The format of the Ul Dummy command is illustrated in figure 11a. The length of the Ul Dummy command is variable, 
with a minimum value of 6 octets and a maximum value of 79 octets. All octets from octet 4 to the last octet N shall be 
encoded with a hexadecimal value of 2B. 

NOTE 2: The format specified for the Ul Dummy command ensures that a receiving LLC entity will always 

discard it, since the ECS check always fails (no matter what the length of the Ul Dummy command is). 



8 


7 


6 


Bit 
5 


4 


3 


2 


1 


PD=0 


C/R=1 








SAPI=3 


1 


1 


D=0 












N(U) =0 








N(L 


J)=0 








1 E=0 


PM=1 








1 







1 





1 


1 








1 







1 





1 


1 








1 







1 





1 


1 










1 







1 





1 


1 








1 







1 





1 


1 








1 







1 





1 


1 



Octet 1 
Octet 2 
Octet 3 
Octet 4 
Octet 5 
Octet 6 



Octet N-2 (LLC PCS) 
Octet N-1 (LLC PCS) 
Octet N (LLC PCS) 



Figure 11a: Format of the Ul Dummy command 

6.4.3 Combined Information (I) and Supervisory (S) frames 

The function of the information (I) frame is to transfer, across a logical link connection, sequentially-numbered frames 
containing information fields provided by layer 3. This frame shall only be used in the ABM operation. 

Numbered I frames shall also carry supervisory information, and are for this reason also called Ih-S frames. A separate 
S frame is sent when there is no information field to be transferred. Whether an Ih-S or S frame is transmitted as a 
command or as a response is insignificant in the ABM procedures. 
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6.4.3.1 Receive Ready (RR) command / response 

The receive ready (RR) supervisory frame is used by an LLE to: 

indicate that it is ready to receive an I frame; and 

acknowledge previously received I frames numbered up to and including N(R) - 1 (as defined in clause 8). 

In addition to indicate the status of an LLE, the RR frame with the A bit set to 1 may be used by the LLE to request an 
acknowledgement from its peer LLE. 

The transmission of an RR frame shall also indicate the clearance of any busy condition within the sending LLE that 
was reported by the earlier transmission of an RNR frame by the same LLE. 

6.4.3.2 Acknowledgement (ACK) command / response 

The ACK supervisory frame shall be used by an LLE to acknowledge a single or multiple I frames. Frames up to and 
including N(R) - 1, and frame N(R) + 1, have been received correctly. The procedures associated with the ACK control 
field are defined in subclause 8.6.3. 

In addition to indicate the status of an LLE, the ACK frame with the A bit set to 1 may be used by the LLE to request an 
acknowledgement from its peer LLE. 

The transmission of an ACK frame shall also indicate the clearance of any busy condition within the sending LLE that 
was reported by the earlier transmission of an RNR frame by the same LLE. 

6.4.3.3 Selective Acknowledgement (SACK) command / response 

The SACK supervisory frame shall be used by an LLE to acknowledge a single or multiple I frames. Frames up to and 
including N(R) - 1, and frames indicated by the SACK bitmap, have been received correctly. The format of the SACK 
control field is shown in figure 9. The procedures associated with the SACK control field are defined in subclause 8.6.3. 

In addition to indicate the status of an LLE, the SACK frame with the A bit set to 1 may be used by the LLE to request 
an acknowledgement from its peer LLE. 

The transmission of a SACK frame shall also indicate the clearance of any busy condition within the sending LLE that 
was reported by the earlier transmission of an RNR frame by the same LLE. 

6.4.3.4 Receive Not Ready (RNR) command / response 

The receive not ready (RNR) supervisory frame shall be used by an LLE to indicate a busy condition; that is, a 
temporary inability to accept additional incoming I frames. The value of N(R) in the RNR frame acknowledges I frames 
numbered up to and including N(R) - 1 . Subsequent frames, if any, shall not be considered confirmed. The acceptance 
status of those is a matter of further status exchange. 

In addition to indicate the status of an LLE, the RNR frame with the A bit set to 1 may be used by the LLE to request an 
acknowledgement from its peer LLE. 



7 Elements for layer-to-layer communication 

7.1 Definition of service primitives and parameters 

Communications between layers and between entities within the logical link control layer are accomplished by means 
of service primitives. Service primitives represent, in an abstract way, the logical exchange of information and control 
between the logical link control layer and adjacent layers. They do not specify or constrain implementations. 

Service primitives consist of commands and their respective responses associated with the services requested of another 
layer. The general syntax of a primitive is: 

XXX - Generic name - Type (Parameters) 
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where XXX designates the service access point between the LLC layer and the layer providing or using the service. For 
the present document XXX is: 

- "LLGMM" for the SAP between the LLC layer and the GPRS mobility management function; 

- "LL" for the SAPs between the LLEs and layer 3; 

- "GRR" for the SAP between the LLC layer and the RLC/MAC layer; and 

- "BSSGP" for the SAP between the LLC layer and the BSSGP layer. 

7.1.1 Primitives types 

The primitives types defined in the present document are: 

NOTE: For the action sequence of these primitive types, see 3GPP TS 44.001 [7]. 

7.1.1.1 Request 

The Request primitive type is used when a higher layer is requesting a service from the next lower layer. 

7.1.1.2 Indication 

The Indication primitive type is used by a layer providing a service to notify the next higher layer of activities related to 
the Request primitive type of the peer. 



7.1.1.3 



Response 



The Response primitive type is used by a layer to acknowledge receipt, from the next lower layer, of the Indication 
primitive type. 



7.1.1.4 



Confirm 



The Confirm primitive type is used by the layer providing the requested service to confirm that the activity has been 
completed (successfully or unsuccessfully). 

7.1 .2 LLC layer service primitives 

A service primitive specifies the activity that the identified layer should perform. Table 7 lists the primitives defined in 
the present document. 

Table 7: LLC layer service primitives 



Generic Name 


Location 


Type 


Parameters 




MS 1 SGSN 


REQ 1 IND 1 RES | CNF 




GMIVIoLLIVIE 


LLGMM-ASSIGN 


X 


X 


X 








TLLI Old, TLLI New, Ciphering 
Key, Ciphering Algorithm 


LLGMM-RESET 




X 


X 






X 


TLLI 


LLGMM-TRIGGER 


X 




X 








TLLI, Cause 


LLGMM-SUSPEND 


X 




X 








TLLI 


LLGMM-SUSPEND 




X 


X 








TLLI, Page 


LLGMM-RESUME 


X 


X 


X 








TLLI 


LLGMM-PAGE 




X 




X 






TLLI 


LLGMM-IOV 




X 


X 






X 


TLLI 


LLGMM-STATUS 


X 


X 




X 






TLLI, Cause 


LLGMM-PSHO 


X 






X 






TLLI, Ciphering Algorithm 


LLGMM-PSHO 




X 


X 








TLLI, Ciphering Key, Ciphering 
Algorithm 


LLGMM-PSHO 




X 








X 


TLLI, lOV-UI, old XID indicator 


GMIVI o LLE, SNDCP o LLE, SIVIS o LLE, and TOM o LLE 


LL-RESET 1 X 1 X 1 1 X | | | TLLI, old XID indicator 
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Generic Name 


Location 


Ty 


pe 


Parameters 




MS 


SGSN 


REQ 


IND 


RES 


CNF 




LL-ESTABLISH 


X 


X 


X 








TLLI, XID Req 


LL-ESTABLISH 


X 


X 




X 






TLLI, XIDReq, N201-U, N201-I 


LL-ESTABLISH 


X 


X 






X 




TLLI, XID Neg 


LL-ESTABLISH 


X 


X 








X 


TLLI, XID Neg, N201-U, N201-I 


LL-RELEASE 


X 


X 


X 








TLLI, Local 


LL-RELEASE 


X 


X 




X 






TLLI, Cause 


LL-RELEASE 


X 


X 








X 


TLLI 


LL-XID 


X 


X 


X 








TLLI, XID Req 


LL-XID 


X 


X 




X 






TLLI, XIDReq, N201-U, N201-I 


LL-XID 


X 


X 






X 




TLLI, XID Neg 


LL-XID 


X 


X 








X 


TLLI, XID Neg, N201-U, N201-I 


LL-DATA 


X 




X 








TLLI, L3-PDU, Reference, 
QoS Parameters, Radio Priority 


LL-DATA 




X 


X 








TLLI, L3-PDU, Reference, 
QoS Parameters 


LL-DATA 


X 


X 




X 






TLLI, L3-PDU 


LL-DATA 


X 


X 








X 


TLLI, Reference 


LL-UNITDATA 


X 




X 








TLLI, L3-PDU, QoS Parameters, 
Radio Priority, Cipher 


LL-UNITDATA 




X 


X 








TLLI, L3-PDU, QoS Parameters, 
Cipher, Redirect indication, IMSI, 
GMM cause. Redirect complete 


LL-UNITDATA 


X 






X 






TLLI, L3-PDU, Cipher 


LL-UNITDATA 




X 




X 






TLLI, L3-PDU, Cipher, Redirect 
attempt, IMSI 


LL-STATUS 


X 


X 




X 






TLLI, Cause 


LLE ^ RLC/IMAC 


GRR-DATA 


X 




X 








TLLI, LL-PDU, SAPI, Cause, 
QoS Parameters, Radio Priority 


GRR-DATA 


X 






X 






TLLI, LL-PDU 


GRR-UNITDATA 


X 




X 








TLLI, LL-PDU, SAPI, 

QoS Parameters, Radio Priority 


GRR-UNITDATA 


X 






X 






TLLI, LL-PDU 


LLE ^ BSSGP 


BSSGP-DL-UNITDATA 




X 


X 








TLLI, LL-PDU, QoS Parameters, 
RLC Confirm, SAPI, Redirect 
indication, IMSI,GMM cause, V{U) 
for redirect, Redirect complete 


BSSGP-UL-UNITDATA 




X 




X 






TLLI, LL-PDU, Cell Id, Redirect 
attempt, IMSI, V(U) for redirect 


NOTE: Parameters related to MOCN configuration, i.e. Redirect indication, IMSI, GMM cause. Redirect attempt, V{U) 
for redirect, and Redirect complete are applicable only to SAPI 1 . 



7.2 Primitive procedures 
7.2.1 GIVIIVI - LLIVIE primitives 



7.2.1.1 



LLGMM-ASSIGN 



The LLGMM-ASSIGN primitive shall be used by the GPRS mobility management entity to assign, change, or unassign 
the TLLI, the ciphering key (Kc or Kci28) and the ciphering algorithm. 

The TLLI Old and TLLI New parameters shall be interpreted as follows: 

If TLLI Old = all I's and TLLI New t- all I's then TLLI New shall be assigned and used when (re-)transmitting 
LLC frames. If a TLLI Old t- all I's was assigned to the LLME, then TLLI Old is unassigned. Only TLLI New 
shall be accepted when received from the peer. It shall be treated as a TLLI change according to subclause 8.3.2. 
If TLLI Old = all I's was assigned to the LLME, then this shall be treated as a TLLI assignment according to 
subclause 8.3.1, and the LLGMM-ASSIGN-REQ shall be the first primitive sent by GMM in order to enable 
LLC to process requests from layer 3. 
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- If TLLI Old i^ all I's and TLLI New i^ all I's then TLLI Old and TLLI New are assigned, and TLLI New shall be 
used when (re-)transmitting LLC frames. Both TLLI Old and TLLI New shall be accepted when received from 
the peer. It shall be treated as a TLLI change according to subclause 8.3.2. 

- If TLLI Old i^ all I's and TLLI New = all I's then TLLI Old shall be unassigned. It shall be treated as a TLLI 
unassignment according to subclause 8.3.3, and the LLGMM-ASSIGN-REQ shall be the last primitive sent by 
GMM in order to disable LLC to not any longer process requests from layer 3. 

An LLC frame received with a DLCI belonging to an unassigned TLLI shall be discarded without any further actions, 
with the following exception: UI and XID frames with TLLI = unassigned and SAPI = 1 received in the SGSN shall be 
handled according to the LLC protocol. 

Ciphering Keyand Ciphering Algorithm are associated with TLLI New (and with TLLI Old if assigned): 

If Ciphering Algorithm indicates no ciphering, then the ciphering function shall be disabled. 

Otherwise, the ciphering function shall be enabled. If a Ciphering Algorithm was already associated with TLLI 
New or TLLI Old, then the new Ciphering Key shall replace the previous Ciphering Key, and Ciphering 
Algorithm shall replace the previous algorithm selection. All I frames, and UI frames with the E bit set to 1, shall 
use the new Ciphering Key and algorithm for ciphering. All unacknowledged I frames shall be ciphered using 
the new Ciphering Key and algorithm before retransmission. As an implementation option, the previous 
Ciphering Key and algorithm may be used to decipher received frames. 

7.2.1.2 LLGMM-RESET 

LLGMM-RESET-REQ shall be used to order LLC in the SGSN to perform an XID negotiation of Reset and lOV-UI. 
The LLC layer shall randomly select the value of lOV-UI. 

LLGMM-RESET-CNF shall be used to inform GMM in the SGSN that a successful XID negotiation of Reset and 
lOV-UI has been made. 

7.2.1.3 LLGMM-TRIGGER 

LLGMM-TRIGGER-REQ shall be used in the MS to order LLC to transmit any single frame. 

If there is a frame waiting to be transmitted in the MS, then this frame shall be transmitted on the corresponding SAPI 
or optionally a UI frame with no information field shall be transmitted on any SAPI. Otherwise if Cause indicates Cell 
Update and if Cell Notification is indicated by the SGSN (see 3GPP TS 24.008 [8a]), then a NULL frame with P=0 
shall be transmitted on any SAPI. Otherwise, and if the LLE is in ABM state, a supervisory frame shall be transmitted 
according to subclause 8.6.4.1 or optionally a UI frame with no information field shall be transmitted on any SAPI. 
Otherwise, and if the LLE is in ADM state a UI frame with no information field shall be transmitted. There is only need 
to transmit one frame on one SAPI. 

LLGMM-TRIGGER-REQ is normally used for cell updates or for page responses, and the reason shall be indicated in 
the Cause parameter. If Cause indicates page response, then the GRR-D ATA-REQ Cause parameter shall also indicate 
page response. 

7.2.1.4 LLGMM-SUSPEND 

LLGMM-SUSPEND-REQ shall be used to order LLC to suspend operation for an MS until LLGMM-RESUME-REQ 
is received. While suspended, LLC shall: 

reset timer T201 if running and (in the SGSN) if the Page parameter is not set; and 

stop frame transmission. 

Frame reception shall still be possible. The Page parameter in the SGSN controls whether LLGMM-PAGE-IND shall 
be sent to GMM or not (see subclause 7.2. L6). In the MS, and in the SGSN if the Page parameter is not set, ADM 
procedures for SAPI = 1 including UI frame transmission shall still be possible, and ABM (re-)establishment, ABM 
release, and XID negotiation procedures on all SAPIs including U frame transmission shall still be possible. 

L3-PDUs and unacknowledged I frames that are buffered shall be preserved while LLC operation is suspended, and 
may be deleted by procedures allowed while LLC operation is suspended. 
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The state (e.g., ABM, ADM) and the state variables (e.g. the transmit and receive counters) shall be preserved while 
LLC operation is suspended, and may be changed by procedures allowed while LLC operation is suspended. 

7.2.1.5 LLGMM-RESUME 

LLGMM-RESUME-REQ shall be used to order LLC to resume a suspended operation for an MS. LLC operation shall 
continue with the current set of buffered L3-PDUs, buffered unacknowledged I frames, the state, and the state variables. 
If timer T201 was reset upon reception of LLGMM-SUSPEND-REQ then timer T201 shall be set. 

7.2.1.6 LLGMM-PAGE 

If the Page parameter received in the LLGMM-SUSPEND-REQ primitive is set to true, LLGMM-PAGE-IND shall be 
sent to GMM in the SGSN whenever LLC has an LL-PDU ready for transmission and LLC operation is suspended. The 
LL-PDU shall not be transmitted until LLGMM-RESUME-REQ has been received from GMM. 

If the Page parameter is set to false, LLGMM-PAGE-IND shall not be sent, and the LL-PDU shall not be transmitted 
until LLGMM-RESUME-REQ has been received from GMM. 

NOTE: LLGMM-PAGE-IND causes GMM to initiate paging of the MS. 

7.2.1.7 LLGMM-IOV 

LLGMM-IOV-REQ shall be used to order LLC in the SGSN to perform an XID negotiation of lOV-UI. The LLC layer 
shall randomly select the value of lOV-UI. 

LLGMM-IOV-CNF shall be used to inform GMM in the SGSN that a successful XID negotiation of lOV-UI has been 
made. 

7.2.1.8 LLGMM-STATUS 

LLGMM-STATUS-IND shall be used to inform GMM when an LLC error that cannot be corrected by the LLC layer 
has occurred. 

7.2.1.9 LLGMM-PSHO 

The LLGMM-PSHO primitives shall be used in the SGSN during PS Handover (see 3GPP TS 43.129 [26]) as follows: 

LLGMM-PSHO-REQ shall be used by GMM to provide LLC with the local TLLI to be associated with the 
mobile station in the new cell. It is used to order LLC in the SGSN to select an lOV-UI. The LLC layer shall 
randomly select the value of lOV-UI. It is further used to assign the ciphering key (Kc or Kci28) and the 
ciphering algorithm. 

LLGMM-PSHO-CNF shall be used by LLC to confirm the local TLLI allocation. It is used to indicate whether 
each LLE shall use the default configuration for the LLC layer parameters and layer-3 parameters or shall re- 
initialize the latest negotiated configuration for the LLC layer parameters and layer-3 parameters after PS 
Handover. It is further used to provide the selected lOV-UI value to use after PS Handover. 

The LLGMM-PSHO primitives shall be used in the MS during PS Handover (see 3GPP TS 43.129 [26]) as follows: 

LLGMM-PSHO-IND shall be used by LLC to indicate the Ciphering Algorithm. 

7.2.2 Layer 3 - LLE primitives 
7.2.2.1 LL-RESET 

LL-RESET-IND shall be used in the SGSN to indicate that the Reset XID parameter is transmitted to the MS. LL- 
RESET-IND shall be used in the MS to indicate that the Reset XID parameter has been received from the SGSN or that 
a Reset is requested in a PS handover. In case of a PS Handover the old XID indicator indicates whether to keep the 
configuration for the layer-3 parameters that was applicable before the receipt of the LL-RESET-IND 
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7.2.2.2 LL-ESTABLISH 

The LL-ESTABLISH primitives shall be used to request, indicate, respond to, and confirm establishment of ABM 
operation. XID Req and XID Neg are used to negotiate layer-3 XID parameters between the layer-3 peers, see 
3GPPTS 44.065 [11]. 

7.2.2.3 LL-RELEASE 

The LL-RELEASE primitives shall be used to request, indicate, and confirm termination of a previously established 
ABM operation. The Local parameter indicates whether the termination shall be local, i.e., a DISC frame shall not be 
transmitted, or not local, i.e. a DISC frame shall be transmitted. The Cause parameter indicates the cause for termination 
of ABM operation. 

7.2.2.4 LL-XID 

The LL-XID primitives shall be used to request, indicate, respond to, and confirm negotiation of layer-3 XID 
parameters. 

7.2.2.5 LL-DATA 

The LL-DATA primitives shall only be used for LLEs in ABM. The following operations are defined: 

LL-DATA-REQ shall be used to request the confirmed transmission of an L3-PDU to the peer. QoS Parameters 
in the SGSN includes precedence class, delay class, and peak throughput. QoS Parameters in the MS includes 
peak throughput. QoS Parameters is defined as part of the Quality of Service information element in 
3GPP TS 24.008 [8a]. Radio Priority indicates the radio priority level to be used by RLC/MAC. 

LL-DATA-IND shall be used to deliver a correctly received L3-PDU to layer 3. 

LL-DATA-CNF shall be used to confirm the delivery of an L3-PDU to layer 3 in the peer. The Reference 
parameter shall be set to the same value as the Reference parameter received in the corresponding LL-DATA- 
REQ. 

7.2.2.6 LL-UNITDATA 

LL-UNITDATA-REQ shall be used to request the unconfirmed transmission of an L3-PDU to the peer. QoS Parameters 
in the SGSN includes precedence class, delay class, reliability class, and peak throughput. QoS Parameters in the MS 
includes peak throughput and reliability class. Reliability class indicates whether the UI frame carrying the L3-PDU 
shall be transmitted in protected or unprotected mode, and whether RLC/MAC acknowledged or unacknowledged mode 
shall be used. Radio Priority indicates the radio priority level to be used by RLC/MAC. Cipher indicates whether the 
UI frame shall be ciphered or not. 

Redirect indication, if included, indicates that the SGSN in a multi -operator core network (MOCN) configuration (see 
3GPP TS 23.251 [5b]) cannot serve the L3 request. IMSI indicates the IMSI of the UE that is associated with the LLE. 
GMM cause is the cause code in the L3 message. Redirect complete, if included, indicates that the SGSN will serve the 
L3 request. Redirect indication and redirect complete shall not both be included. 

LL-UNITDATA-IND shall be used to deliver an L3-PDU received in a UI frame to layer 3. Cipher indicates whether 
the received UI frame was ciphered or not. Redirect attempt and IMSI indicate parameters related to MOCN 
configuration that are to be forwarded with the L3-PDU received in the associated BSSGP-UL-UNITDATA-IND 
primitive. 

NOTE: The MOCN parameters map to BSSGP information elements as described in 3GPP TS 48.018 [12] 

7.2.2.7 LL-STATUS 

LL-STATUS-IND shall be used to inform layer 3 when an LLC error that cannot be corrected by the LLC layer has 
occurred. 
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7.2.3 LLE - RLC/MAC primitives 



Although the GRR-DATA or GRR-UNITDATA primitives are used in all LLC frame transfer operations, for simplicity 
reasons they are not included in the procedure descriptions in clause 8. 

7.2.3.1 GRR-DATA 

GRR-DATA-REQ shall be used by an LLE in an MS to request the reliable transmission of an LL-PDU. SAPI indicates 
the SAPI of the LLE. Cause indicates whether GRR-DATA-REQ is sent due to a page response. QoS Parameters 
includes peak throughput. For UI frames, peak throughput shall be set according to the QoS parameters of the layer-3 
entity requesting the transmission of the UI frame. For all other LLC frames, peak throughput may be set according to 
the QoS parameters for any layer-3 entity that is using the SAPI. Radio Priority indicates the radio priority level to be 
used by RLC/MAC. 

GRR-DATA-IND shall be used by the RLC/MAC layer in an MS to indicate the successful reception of an LL-PDU. 
The LL-PDU was completely received without errors detected by the RLC layer. 

All LLC frames except UI frames for SAPIs 3, 5, 9, and 1 1 shall be transferred with GRR-DATA primitives. All 
UI frames for SAPIs 3, 5, 9, and 11 shall be transferred with GRR-DATA or GRR-UNITDATA primitives. 

7.2.3.2 GRR-UNITDATA 

GRR-UNITDATA-REQ shall be used by an LLE in an MS to request the unreliable transmission of a UI frame. SAPI 
indicates the SAPI of the LLE. QoS Parameters includes peak throughput. Peak throughput shall be set according to the 
QoS parameters of the layer-3 entity requesting the transmission of the UI frame. Radio Priority indicates the radio 
priority level to be used by RLC/MAC. 

GRR-UNITDATA-IND shall be used by the RLC/MAC layer in an MS to indicate the reception of a UI frame. 

Only UI frames for SAPIs 3, 5, 9, and 1 1 shall be transferred with GRR-UNITDATA primitives. 



7.2.4 LLE - BSSGP primitives 



Although the BSSGP-UNITDATA primitives are used in all LLC frame transfer operations, for simplicity reasons they 
are not included in the procedure descriptions in clause 8. 

7.2.4.1 BSSGP-DL-UNITDATA 

BSSGP-DL-UNITDATA-REQ shall be used by an LLE in an SGSN to request the transmission of an LL-PDU. QoS 
Parameters includes precedence class, delay class, and peak throughput. RLC Confirm indicates whether the request 
shall be mapped into a GRR-DATA-REQ or GRR-UNITDATA-REQ primitive in the BSS. SAPI indicates the SAPI of 
the LLE. 

All LLC frames except UI frames for SAPI 3, 5, 9 and 11 shall be transferred with RLC Confirm indicating mapping 
into GRR-DATA-REQ primitive. All UI frames for SAPIs 3, 5, 9, and 1 1 shall be transferred with RLC Confirm 
indicating mapping into a GRR-DATA-REQ or GRR-UNITDATA-REQ primitives. 

In a MOCN configuration. Redirect indication, IMSI, GMM cause, and Redirect complete indicate the values received 
for the same parameters in the associated LL-UNITDATA-IND primitive on SAPI 1, if included with the L3 PDU to be 
transferred. 

If Redirect indication is included with the L3 PDU to be transferred by the SAPI 1 LLE, the V(U) for redirect parameter 
value shall be set to N(U) + 1 where N(U) is the value included in the header of the LL-PDU. 

NOTE: The decision of whether to include MOCN parameters in the associated BSSGP PDU is taken in BSSGP 
(see 3GPPTS 48.018 [12]). 

7.2.4.2 BSSGP-UL-UNITDATA 

BSSGP-UL-UNITDATA-IND shall be used by the BSSGP layer in an SGSN to indicate the reception of an LL-PDU. 
Cell Id indicates the location of the MS when the LL-PDU was transmitted. 
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In a MOCN configuration, for SAPI 1, the Redirect attempt, IMSI, and V(U) for redirect parameters may apply. 
Redirect attempt indicates that the L3 PDU has been redirected by another SGSN. IMSI indicates the IMSI as defined in 
3GPP TS 23.003 [3a] corresponding to the UE associated with the LLE. If the V(U) for redirect parameter is included, 
the SAPI 1 LLE in the SGSN shall set its value of V(U) equal to the value of the V(U) for redirect parameter received. 
Redirect attempt and IMSI are forwarded to GMM along with the L3 PDU. 

7.2.5 LLME - LLE primitives 

The primitives that co-ordinate activities between the LLM and LL entities are not described. Implementations shall 
perform the necessary co-ordination between GMM «-^ LLME primitives and LLE operation. 



8 Definition of the LLC peer-to-peer protocol 

8.1 General 

In the following subclauses, a protocol for use by the GPRS logical link control layer between the SGSN and MS is 
specified, referred to as "LLC". 

The LLC elements of procedure (frame types) that apply are: 

for unacknowledged information transfer: 

UI command; and 
for ABM acknowledged information transfer: 
- SABM command; 

UA response; 

DM response; 

DISC command; 

RR command / response; 

RNR command / response; 

ACK command / response; 

SACK command / response; 

I command / response; and 
for both unacknowledged and acknowledged information transfer: 

FRMR response; and 

XID command / response. 
For handling of timers, the procedures and terminology of ITU-T Recommendation Z.IOO [15] are used: 
Set <timer name> means that: 

a) if the timer is inactive, the timer becomes active, i.e., a timer value is associated with the timer and it starts 
running; and 

b) if the timer is active, the timer is first reset as in c) below, and then set as in a) above. 



£75/ 



3GPP TS 44.064 version 10.1.0 Release 10 



40 



ETSI TS 144 064 VI 0.1.0 (2012-01) 



Reset <timer name> means that: 

c) if the timer is active, the timer becomes inactive, i.e., the association with the timer value is lost and it stops 
running; and 

d) if the timer is inactive, it remains inactive. 



8.2 



Procedure for the use of the P/F bit 



Timer T200 shall be set when a command frame with the P bit set to 1 is transmitted. An LLE receiving a command 
frame with the P bit set to 1 shall set the F bit to 1 in the next response frame it transmits. An LLE receiving a command 
frame with the P bit set to shall discard the command frame with no further action. 

Only one frame with a P bit set to 1 shall be outstanding in a given direction at a given time. Before another frame with 
the P bit set to 1 can be transmitted, a response frame with the F bit set to 1 shall be received, N200 retransmissions of 
the outstanding frame shall occur, or the frame shall be discarded because of an unnumbered frame collision. 



8.3 TLLI assignment procedures 



TLLI assignment and unassignment is further described in clause 7 and annex C. The following two subclauses 
illustrate the TLLI assignment and unassignment procedures. 

8.3.1 TLLI assignment 

GMM shall assign a TLLI by sending an LLGMM-ASSIGN-REQ (TLLI New i^ all I's) primitive to LLME. Upon 
receiving LLGMM-ASSIGN-REQ, LLME shall enter the TLLI Assigned state, and set LLC layer parameters, states, 
and variables as defined in subclause 8.5.3. L TLLI assignment is illustrated in figure 12. 

8.3.2 TLLI change 

This procedure is used to change from a previously assigned TLLI value to a new TLLI value. GMM shall change TLLI 
by sending an LLGMM-ASSIGN-REQ (TLLI Old i^ all I's, TLLI New ^ all I's) primitive to LLME. Upon receiving 
LLGMM-ASSIGN-REQ, LLME and all its LLEs shall not change their states. This is illustrated in figure 12. 

8.3.3 TLLI unassignment 

This procedure is used to unassign a previously assigned TLLI value. GMM shall unassign a TLLI by sending an 
LLGMM-ASSIGN-REQ (TLLI New = all I's) primitive to LLME. Upon receiving LLGMM-ASSIGN-REQ, LLME 
and all its LLEs shall enter the TLLI Unassigned state. This is illustrated in figure 12. 



GMM 



MS 



LLC 



LLGMM-ASSIGN-RB 



%. 



LLC 



SGSN 



GMM 



L LGMM-ASSIGN-REQ 



Figure 12: TLLI assignment, change, and unassignment procedure 
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8.4 Procedures for unacknowledged information transfer 

The procedures that apply to the unacknowledged transmission of information are defined below. No LLC layer error 
recovery procedures are defined for unacknowledged operation. 



Layer 3 



Originator 



LLC 



LL-UNITDATA-REQ 



Ul 




Figure 13: Unacknowledged information transmission 

8.4.1 Transmission of unacknowledged information 

Unacknowledged information shall be passed from layer 3 to the LLC layer with the LL-UNITDATA-REQ (L3-PDU, 
Protect, Cipher) primitive. The L3-PDU shall be transmitted in a UI command frame to the peer LLE. The PM and 
E bits in the UI frame shall be set according to the Protect and Cipher parameters received from layer 3. 

8.4.2 Receipt of unacknowledged information 

On receipt of a UI command frame the contents of the information field shall be passed to the appropriate layer-3 entity 
with an LL-UNITDATA-IND (L3-PDU) primitive, except: 

if the DLCI of the received UI frame is not supported by the receiver; or 

- if N(U) of the received UI frame is in the range ( V(UR) - 32 ) < N(U) < V(UR) and if a UI frame with the same 
N(U) has already been received, 

then the UI frame shall be discarded without any further actions. 

V(UR) shall be set to N(U) + 1 unless N(U) is in the range ( V(UR) - 32 ) < N(U) < V(UR). 

8.5 Procedures for establishment and release of ABM operation 
8.5.1 Establishment of ABM operation 
8.5.1.1 General 

These procedures shall be used to establish ABM operation between the SGSN and an MS for a single SAPI. 

Layer 3 shall request establishment of ABM operation by use of the LL-ESTABLISH-REQ service primitive. Re- 
establishment may be initiated as a result of the LLC layer procedures defined in subclause 8.7. All frames other than U 
and UI frames received during the establishment procedures shall be ignored. 



8.5.1.2 



Establishment procedures 



An LLE shall initiate a request for the ABM operation to be set by transmitting the SABM command. All existing 
exception conditions shall be cleared, the retransmission counter shall be reset, and timer T200 shall be set. All mode- 
setting commands shall be transmitted with the P bit set to 1 . 

Layer 3-initiated establishment procedures imply the discard of all outstanding LL-DATA-REQ primitives and all 
queued I frames. 
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An LLE receiving a SABM command, if it is able to enter the ABM state, shall: 

inform layer 3 using the LL-ESTABLISH-IND primitive; 

if the received SABM command contains a Layer-3 Parameters XID parameter, wait for the receipt of an LL- 
ESTABLISH-RES primitive from layer 3; 

respond with a UA response with the F bit set to the same binary value as the P bit in the received SABM 
command (i.e., F=l); 

reset timer T200 if active; 

- set V(S), V(R), V(A), and B to 0; 

- enter the ABM state; 

clear all existing exception conditions; and 
clear any existing peer receiver busy condition. 
Upon reception of the UA response with the F bit set to 1, the originator of the SABM command shall: 
reset timer T200; 

- set V(S), V(R), V(A), and B to 0; and 

- enter the ABM state and inform layer 3 using the LL-ESTABLISH-CNF or LL-ESTABLISH-IND (see 
subclause 8.7.2) primitive. 
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Figure 14: Layer 3-initiated ABM establishment procedure 

If the receiving LLE is unable to enter the ABM state, it shall respond to the SABM command with a DM response with 
the F bit set to the same binary value as the P bit in the received SABM command. ABM operation for SAPIs 1, 2, 7, 
and 8 is not permitted, and reception of a SABM command for these SAPIs shall be responded to with a DM response. 

Upon reception of a DM response with the F bit set to 1, the originator of the SABM command shall indicate this to 
layer 3 by means of the LL-RELEASE-IND (Cause = 'DM Received') primitive, and reset timer T200. It shall then 
enter the ADM state. DM responses with the F bit set to shall be ignored in this case. 



Layer 3 



Originator 



LLC 



LL-ESTABLISH-REQ 



LL-RELEASE-IND 

^ 



LLC 



SABM 



DM 



Receiver 



Layer 3 



Figure 15: Layer 3-initiated ABM establishment procedure, unsuccessful 
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An LL-RELEASE-REQ primitive received during LLC layer initiated re-establishment shall be serviced on completion 
of the establishment operation. 

8.5.1 .3 Procedure on expiry of timer T200 

If timer T200 expires before the UA or DM response with the F bit set to 1 is received, the LLE shall: 

retransmit the SABM command as defined above; 

set timer T200; and 

increment the retransmission counter. 

After retransmission of the SABM command N200 times, LLME shall indicate this to GMM by means of the LLGMM- 
STATUS-IND primitive, and the LLE shall send an LL-RELEASE-IND (Cause = 'No Peer Response') to layer 3 and 
enter ADM state. If XID parameters were included with the SABM command, then the status of these parameters in the 
peer is unknown and should be re-negotiated. 

8.5.2 Termination of ABM operation 

8.5.2.1 General 

These procedures shall be used to terminate ABM operation between the SGSN and an MS. 

Layer 3 shall request termination of ABM operation by use of the LL-RELEASE-REQ service primitive. All frames 
other than U and UI frames received during the release procedures shall be ignored. 

All outstanding LL-DATA-REQ primitives and all queued I frames shall be discarded. 

If the Local parameter received in the LL-RELEASE-REQ primitive indicates local release, the LLE shall enter ADM 
state, reset timer T200, and notify layer 3 by means of the LL-RELEASE-CNF primitive. Otherwise, the procedures in 
subclauses 8.5.2.2 and 8.5.2.3 shall be followed. 

8.5.2.2 Release procedure 

An LLE shall initiate a request for release of the ABM operation by transmitting the DISC command with the P bit set 
to 1. Timer T200 shall then be set and the retransmission counter reset. 

An LLE receiving a DISC command while in ABM state shall transmit a UA response with the F bit set to the same 
binary value as the P bit in the received DISC command. An LL-RELEASE-IND (Cause = 'Normal Release') primitive 
shall be passed to layer 3, and the ADM state shall be entered. 

If the originator of the DISC command receives either: 

a UA response with the F bit set to 1 ; or 

a DM response with the F bit set to 1, indicating that the peer LLE is already in ADM state; 

it shall enter the ADM state and reset timer T200. 

The LLE that issued the DISC command is now in the ADM state and shall notify layer 3 by means of the LL- 
RELEASE-CNF primitive. The conditions relating to this state are defined in subclause 8.5.4. 
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Figure 16: ABM release procedure 



8.5.2.3 



Procedure on expiry of timer T200 



If timer T200 expires before a UA or DM response with the F bit set to 1 is received, the originator of the DISC 
command shall: 

retransmit the DISC command as defined in subclause 8.5.2.2; 

set timer T200; and 

increment the retransmission counter. 

If the LLE has not received the correct response as defined in subclause 8.5.2.2 after N200 attempts to recover, then 
LLME shall indicate this to GMM by means of the LLGMM-STATUS-IND primitive, and the LLE shall enter the 
ADM state and notify layer 3 by means of the LL-RELEASE-CNF primitive. 

8.5.3 Automatic negotiation of LLC layer and layer-3 parameters 

Each LLE has an associated LLME that has the responsibility for initialising the LLC layer parameters necessary for 
correct peer-to-peer information transport. Initialisation of the parameters shall be done either according to the default 
values, or according to the values supplied by the peer entity. The latter method utilises the parameter negotiation 
procedure. The negotiable parameters are listed in table 6. 

LLC layer and layer-3 parameters may be negotiated in ADM or ABM modes of operation. LLC layer and layer-3 
parameters may be negotiated with the exchange of XID frames, or with the exchange of S ABM and UA frames. After 
successful negotiation with SABM and UA frames, the LLE shall be in ABM mode of operation, according to 
subclauses 8.5.1 and 8.7. 

The LLE shall issue an XID command containing the parameters that the LLE wants to negotiate, and set timer T200. 
The peer LLE shall, upon receipt of the XID command, return an XID response containing the list of parameter values 
that the peer can support. Timer T200 shall be reset when the XID response is received. XID frames shall be transmitted 
with the P/F bit set to I. This is illustrated in figure 17. 
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Figure 17: XID negotiation procedure 

LL-XID-IND shall be indicated to layer 3 if N201-U or N201-I have been changed. 
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XID frames can be used to negotiate layer-3 parameters. In this case, layer 3 sends the parameters to an LLE with the 
LL-XID-REQ primitive. The LLE shall issue an XID command containing the layer-3 parameters, and LLC layer 
parameters if any LLC layer parameters shall be negotiated. The peer LLE shall, upon receipt of the XID command, 
indicate the layer-3 parameters to layer 3 and upon receipt of an LL-XID-RES primitive return an XID response 
containing the list of parameter values that the peer can support. The layer-3 parameters received from the peer is sent 
to layer 3 with the LL-XID-CNF primitive. The LLE issuing the XID command shall set timer T200 when the XID 
command is transmitted, and reset timer T200 when the XID response is received. This is illustrated in figure 18. 
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Figure 18: Layer 3 XID negotiation procedure 

8.5.3.1 Negotiation of parameter Reset 

The Reset parameter shall be used, in the SGSN originating Reset and in the MS receiving Reset, to: 

discard all requests pending from layer 3 to the LLEs with no further action; 

abort any ongoing ABM establishment, ABM release, and XID negotiation procedures, except the XID 
negotiation procedure used to negotiate the Reset parameter; 

if the old XID indicator is set, keep the LLC layer parameter values that were applicable before the receipt of the 
Reset. Otherwise, set all LLC layer parameters to the default values given in table 9; 

- change any LLEs in ABM state to ADM state; 

set the unconfirmed state variable V(U) to 0; 

set the unconfirmed receive state variable V(UR) to 0; and 

set the OCs for unacknowledged information transfer to 0. 

The Reset parameter shall be treated before any additional XID parameters present in the same XID frame. 

If during PS handover the MS is requested to perform a Reset of LLC layer parameters and layer-3 parameters (see 
3GPP TS 24.008 [8a]), the MS shall perform the actions described above and shall send the XID response on one of the 
active SAPIs once the PS handover procedure has been successfully completed (see 3GPP TS 44.060 [76]). 

If Reset of LLC layer paramers and layer-3 parameters without old XID indicator has been performed, following the 
sending of the XID response each active LLE in the MS shall: 

set timer TlOO; and 

not initiate any XID negotiation procedure while TlOO is running. 

If an LL-XID-REQ primitive is received from layer 3 at the time TlOO is running, depending on implementation, the 
LLE shall abort or delay it until TlOO expires or is reset. 

Upon receipt of an XID command, the LLE shall: 

reset timer TlOO, and: 
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the LLE shall proceed according to the negotiation of LLC layer and layer-3 parameters described in the 

subclause 8.5.3. 

NOTE: The reception of an empty XID command is an indication that the SGSN wishes to continue using default 
values (see 3GPP TS 43.129 [26]). 

If timer TlOO expires, the LLE is again allowed to initiate XID negotiation procedure. 

8.5.3.2 Negotiation of parameter m 

The following rules shall apply when mD and mU are negotiated: 

If mD is negotiated to 0, then the LLEs shall not keep count of outstanding I frame octets in the downlink 
direction. If mU is negotiated to 0, then the LLEs shall not keep count of outstanding I frame octets in the uplink 
direction. 

If a S ABM or XID command with mD ^^^ is received in an LLE, and if the LLE does not want to apply the 
count of outstanding I frame octets in the downlink direction, then the LLE shall respond with mD = and with 
N201-I and kD so that N201-I multiplied with kD is less than or equal to the received MD. 

If a S ABM or XID command with mU ;^ is received in an LLE, and if the LLE does not want to apply the 
count of outstanding I frame octets in the uplink direction, then the LLE shall respond with mU = and with 
N201-I and kU so that N201-I multiplied with kU is less than or equal to the received MU. 

mD and mU shall be negotiated to values that allow at least one I frame with information field length equal to 
the negotiated value of N201-I to be transmitted in each direction. 

8.5.3.3 Unsuccessful XID negotiation 

If a S ABM or XID command with an invalid XID information field is received, then the SABM or XID command, 
respectively, shall be ignored. 

If a UA or XID response with an invalid XID information field is received, then the UA or XID response shall be 
ignored, the SABM or XID command shall be retransmitted, and the retransmission counter shall be incremented. After 
retransmission of the SABM or XID command N200 times, LLME shall indicate this to GMM by means of the 
LLGMM-STATUS-IND primitive, and the LLE shall send an LL-RELEASE-IND (Cause = Invalid XID Response') to 
layer 3 if a UA response was received or if the LLE was in ABM state, and enter ADM state if not already in ADM 
state. If the LLE was in ADM state and the XID command frame contained a Layer-3 Parameters XID parameter, then 
the LLE shall send an LL-STATUS-IND (Cause = 'Invalid XID Response') to layer 3. 

An XID information field shall be treated as invalid if it: 

contains an XID parameter field that violates the LLC frame format (see figure 3); 

contains the Reset, lOV-UI, or lOV-I parameter in the uplink direction; 

contains the lOV-I parameter in an XID frame; 

contains the Layer-3 Parameters parameter on a SAPI different from 3, 5, 9, and 11; 

in the SABM command case, contains the Reset parameter; 

contains the Reset parameter and this parameter is not the first parameter in the XID information field; or 

in the UA or XID response case: 

contains the Reset parameter; 

contains more than one instance of the same XID parameter type; 

contains an XID parameter with unrecognised Type field; 

contains an XID parameter with unsupported length; 

contains an XID parameter with a value that violates the sense of negotiation; or 
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contains an XID parameter with a value that is out of range (see table 6). 

If a S ABM or XID command with an XID parameter with an unrecognised Type field is received, then this parameter 
shall be ignored. If a S ABM or XID command contains more than one instance of the same XID parameter type, then 
all instances except the first instance shall be ignored. If the received XID information field is valid, and if one or more 
XID parameters with recognised type but with unsupported lengths or out-of-range values are detected, then these 
parameters shall be responded to with lengths and values set according to the responder's preferences. 

8.5.3.4 Procedure on expiry of timer T200 

If timer T200 expires before the XID response with the F bit set to 1 is received, the LLE shall: 

retransmit the XID command; 

set timer T200; and 

increment the retransmission counter. 

After retransmission of the XID command N200 times, LLME shall indicate this to GMM by means of the LLGMM- 
STATUS-IND primitive, and, if the LLE is in ABM state, then the LLE shall send an LL-RELEASE-IND (Cause = 'No 
Peer Response') to layer 3 and enter ADM state. If the LLE was in ADM state and the XID command frame contained a 
Layer-3 Parameters XID parameter, then the LLE shall send an LL-STATUS-IND (Cause = No Peer Response') to 
layer 3. The status of the XID parameters that were included in the XID command is unknown in the peer, and should 
be re-negotiated. If the XID command frame did not contain a Layer-3 Parameters XID parameter, then, as an 
implementation option, the LLE may wait for an implementation-specific amount of time and re-invoke the XID 
negotiation procedure. 

8.5.4 TLLI Assigned / ADM state 

While in the TLLI Assigned / ADM state: 

the receipt of a DISC command shall result in the transmission of a DM response with the F bit set to the value 
of the received P bit; 

on receipt of a SABM command, the procedures defined in subclause 8.5. 1 shall be followed; 

on receipt of UI commands, the procedures defined in subclause 8.4 shall be followed; 

on receipt of XID commands, the procedures defined in subclause 8.5.3 shall be followed; 

on receipt of any unsolicited UA response an LLGMM-STATUS-IND primitive indicating a possible 
multiple-assignment of a TLLI value shall be issued; 

the receipt of an S or l+S command frame shall result in the transmission of a DM response with the F bit set to 
0;and 

all other frame types shall be discarded. 

8.5.5 Collision of unnumbered commands 

In the collision cases in this subclause, if the XID or SABM command that shall be ignored and treated as not 
transmitted contains one or more XID parameters that are not negotiated as part of the collision resolution, then 
negotiation of these XID parameters shall be performed at the earliest opportunity after conclusion of the collision 
resolution. 

If the MS receives an XID command with a valid XID information field that contains the Reset parameter, or if during a 
PS handover the MS receives a request from the lower layers to perform a Reset with or without old XID indicator, the 
MS shall abort any ongoing XID negotiation and treat the received XID command or request from the lower layers. 
This requirement takes precedence over the collision cases in this subclause. 
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8.5.5.1 



Identical transmitted and received commands 



If the transmitted and received unnumbered commands are S ABM commands and a Layer-3 Parameters XID parameter 
is present in both or in neither, then the SABM command transmitted by the SGSN shall be ignored and treated as not 
transmitted. The LLE in the SGSN shall send the UA response at the earliest possible opportunity if it is able to enter 
ABM. 

If the transmitted and received unnumbered commands are a SABM command with a Layer-3 Parameters XID 
parameter and a SABM command without a Layer-3 Parameters XID parameter, then the SABM command without 
Layer-3 Parameters shall be ignored and treated as not transmitted. This is illustrated in figure 19. 
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Figure 19: Collision between LLE-initiated and layer 3-initiated ABM establishment procedure 

If the transmitted and received unnumbered commands are DISC commands, then the LLEs shall send the UA response 
at the earliest possible opportunity, and enter ADM state after receiving the UA response. The LLEs shall notify layer 3 
by means of the LL-RELEASE-CNF primitive. 

If the transmitted and received unnumbered commands are XID commands and a Layer-3 Parameters XID parameter is 
present in both or in neither, then the XID command transmitted by the SGSN shall be ignored and treated as not 
transmitted. 

If the transmitted and received unnumbered commands are an XID command with a Layer-3 Parameters XID parameter 
and an XID command without a Layer-3 Parameters XID parameter, then the XID command without Layer-3 
Parameters shall be ignored and treated as not transmitted. 



8.5.5.2 



Different transmitted and received commands 



If the transmitted and received unnumbered commands are a SABM and a DISC command, the LLEs shall issue a DM 
response at the earliest possible opportunity. Upon receipt of a DM response with the F bit set to 1, the LLE shall enter 
the ADM state and notify layer 3 by means of the appropriate primitive. The LLE receiving the DISC command shall 
issue an LL-RELEASE-IND (Cause = 'Normal Release') primitive, while the other LLE shall issue an LL-RELEASE- 
CNF primitive. 

If the transmitted unnumbered command is a SABM command, and the received unnumbered command is an XID 
command, then the LLE shall ignore the received XID command. 

If the transmitted unnumbered command is an XID command, and the received unnumbered command is a SABM 
command, then the LLE shall send the UA response at the earliest possible opportunity if it is able to enter ABM. The 
transmitted XID command shall be treated as not transmitted. 

If the transmitted and received unnumbered commands are a DISC and an XID command, then this shall not be 
considered a collision. 

8.5.6 Unsolicited DM response and SABM or DISC command 

When a DM response with the F bit set to is received by an LLE, a collision between a transmitted SABM or DISC 
command and the unsolicited DM response may have occurred. 
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In order to avoid misinterpretation of the DM response received, an LLE shall always send its S ABM or DISC 
command with the P bit set to 1 . 

A DM response with the F bit set to colliding with a SABM or DISC command shall be ignored. 

8.6 Procedures for information transfer in ABM operation 

Having either transmitted the UA response to a received SABM command or received the UA response to a transmitted 
SABM, I frames and supervisory frames may be transmitted and received. The procedures that apply to the transmission 
of I frames are defined below. 

NOTE: The term "transmission of an I frame" refers to the delivery of an I frame by the LLC layer to the 
RLC/MAC or BSSGP layer. 

Each LLE shall store the history of the transmitted I frames, i.e., the LLE shall remember the I-frame transmission 
sequence. The history is used to decide which I frames to retransmit. Due to retransmission, the history is not 
necessarily an in-order sequence. 

A frame within the receive window is either: 

received: the frame has been correctly received; or 

not received: the frame has not been correctly received. 
A frame within the transmit window is either: 

not yet transmitted: the frame has not yet been transmitted; 

transmitted: the frame has been (re-)transmitted, but the LLE does not know if the frame has been received in the 
peer LLE; 

acknowledged: the frame has been acknowledged by the peer LLE; or 

marked for retransmission: the LLE has decided to retransmit this I frame. 

I frames shall be transmitted in ascending N(S) order. When I frames are retransmitted, the frame with the lowest N(S) 
shall be retransmitted first. This is used by the receiving LLE to detect lost frames as described in subclause 8.6.3. L 

8.6.1 Transmitting I frames 

Information received by the LLE from layer 3 by means of an LL-DATA-REQ primitive shall be transmitted in an 
I frame, provided that the LLE is not in the peer receiver busy condition. The control field parameters N(S) and N(R) 
shall be assigned the values V(S) and V(R), respectively. V(S) shall be incremented by 1 at the end of the transmission 
of the I frame. 

The I frame buffer variable B shall be incremented with the length of the information field of I frame number N(S), so 
that B = B + L(N(S)). The value of B shall never exceed M. If L(N(S)) > M - B (where M is the maximum buffer size - 
see subclause 8.9.7), then the LLE shall not transmit any new I frames, but may retransmit I frames as a result of the 
error recovery procedures as described in subclauses 8.6.3 and 8.6.6. 

When there is an opportunity to transmit a frame, then the LLE shall do one of the following in order of priority: 

If there are any I frames marked for retransmission and if the LLE is not in the peer receive busy condition, then 
the LLE shall increment by 1 the retransmission count variable for the I frame with the lowest send sequence 
number N(S). If the retransmission count variable exceeds the value of N200, then the LLE shall initiate the re- 
establishment procedure as described in subclause 8.7.2. If the retransmission count variable does not exceed the 
value of N200, then the LLE shall retransmit the I frame. 

If the LLE has a new I frame to transmit, if V(S) < V(A) + k (where k is the maximum number of outstanding 
I frames - see subclause 8.9.8), and if the LLE is not in the peer receiver busy condition, then the new I frame 
shall be transmitted. 

If the LLE has an acknowledgement to transmit (see subclause 8.6.3.1), then the LLE shall transmit an S frame. 
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If the LLE wants to request an acknowledgement (see subclause 8.6.3.3), then the A bit of the transmitted frame shall 
be set to 1. 

When the SGSN or MS is in the own receiver busy condition, it may still transmit I frames, provided that a peer 
receiver busy condition does not exist. 
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Figure 20: Transmitting and receiving I frames 



8.6.2 Receiving I frames 



When an LLE is not in the own receiver busy condition and receives a valid I frame whose N(S) is equal to the current 
V(R), the LLE shall: 

pass the information field of this frame to layer 3 using the LL-DATA-IND primitive; 

increment by 1 its V(R); and 

if the A bit of the received I frame was set to 1, then the LLE shall respond to its peer with an RR, RNR, SACK, 
or ACK frame (see subclause 8.6.4.1). 

When an LLE receives a valid I frame whose N(S) is not in the range V(R) < N(S) < V(R) + k, the LLE shall discard 
the frame as a duplicate. 

When an LLE is not in the own receiver busy condition and receives a valid I frame where V(R) < N(S) < V(R) + k, 
then the LLE shall store the I frame until all frames from V(R) to N(S) - 1 inclusive are correctly received. The LLE 
shall use the control field information of the received I frame before storing the frame. The LLE shall then: 

pass the information field of this I frame to layer 3 using the LL-DATA-IND primitive; and 

- set its V(R) = N(S) H- L 

When an LLE receives a valid I frame and the LLE is in the own receiver busy condition, then the acceptance of the 
I frame is implementation dependent. 

8.6.3 Sending and receiving acknowledgements 

NOTE: Sending and receiving acknowledgements refer to the transmission and reception of frames carrying 
ABM acknowledgement information, i.e., Ih-S and S frames. 



8.6.3.1 



Sending acknowledgements 



Whenever an LLE receives a frame with the A bit set to 1, it shall transmit an Ih-S or S frame. Whenever an LLE detects 
an error in the sequence of received I frames, it shall transmit an Ih-S or S frame. The supervisory function bits of the 
transmitted frame shall be set according to subclause 8.6.4. L 

The receiving LLE shall use the knowledge of the (re-)transmission strategy of its peer LLE (see subclause 8.6.1) to 
detect sequence errors. If the LLE receives an I frame with a higher N(S) than the N(S) of the previously received 
I frame, and if there are I frames missing between these two N(S) values, then the LLE shall assume that the missing 
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I frames have been lost. If the LLE receives an I frame with a lower N(S) than the N(S) of the previously received 
I frame, it can assume that its peer LLE has (re-)started retransmission due to the reception of an acknowledgement. 

8.6.3.2 Receiving acknowledgements 

On receipt of a valid I+S or S frame , the LLE shall, if N(R) is valid, treat the N(R) contained in this frame as an 
acknowledgement for all the I frames it has transmitted with an N(S) up to and including the received N(R) -LA valid 
N(R) value is one that is in the range V(A) < N(R) < V(S). If N(R) is not valid, then the received A bit shall be treated 
as defined in subclause 8.6.3.1, and N(R), and the SACK bitmap if received, shall be disregarded. 

For each I frame transmitted with N(S) in the range V(A) < N(S) < N(R): 

the LLE shall issue an LL-DATA-CNF primitive to layer 3 to confirm the delivery of an L3-PDU to layer 3 in 
the peer; and 

the frame length L(N(S)) shall be subtracted from the I frame buffer variable B, so that B = B - L(N(S)). The 
value of B shall never be less than 0. 

V(A) shall then be set to N(R). 

On receipt of a valid ACK frame, the LLE shall consider the I frame transmitted with sequence number N(R) + 1 as 
acknowledged. 

On receipt of a valid SACK frame, the LLE shall consider all I frames with the corresponding bit set to 1 in the SACK 
bitmap as acknowledged. 

If timer T201 is active and associated with an acknowledged I frame, then timer T201 shall be reset. 

The LLE shall determine which I frames to retransmit by analysing its I frame transmission sequence history and the 
acknowledgements received. An unacknowledged I frame that was transmitted prior to an acknowledged I frame shall 
be considered lost and shall be marked for retransmission. Acknowledged I frames shall be removed from the I frame 
transmission sequence history. 

8.6.3.3 Requesting acknowledgements 

The LLE shall request an acknowledgement from the peer LLE by transmitting an I+S or S frame with the A bit set 
to 1 . The LLE may request an acknowledgement at any time. An acknowledgement shall be requested when: 

the last I frame in a sequence of one or more I frames is transmitted; or 

B > M - N201 as a result of the transmission of the I frame, unless the next I frame to be transmitted is available 
and has an information field length that is less than or equal to M - B; or 

V(S) = V(A) + k as a result of the transmission of the I frame. 

When requesting an acknowledgement, the LLE shall set timer T201 and associate the timer with the I frame currently 
being transmitted, or, if the A bit is transmitted in an S frame, with the I frame last transmitted. 

8.6.4 Peer receiver busy condition 

After receiving a valid RNR frame, the LLE shall: 

set a peer receiver busy condition; 

not transmit nor retransmit any I frames to the peer LLE; 

treat the N(R) contained in the received RNR frame as an acknowledgement for all the I frames that have been 
(re-)transmitted with an N(S) up to and including N(R) - 1, and set its V(A) to the value of the N(R) contained in 
the RNR frame; 

set timer T201 to initiate the inquiry process; and 

reset the retransmission count variable. 
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If timer T201 expires, the LLE shall: 

if the value of the retransmission count variable is less than N200: 

transmit an appropriate supervisory frame (see subclause 8.6.4.1) with an A bit set to 1; 

set timer T201; and 

add one to its retransmission count variable; 

if the value of the retransmission count variable is equal to N200, initiate a re-establishment procedure as defined 
in subclause 8.7. LLME shall indicate this by means of the LLGMM-STATUS-IND primitive to GMM. 

The LLE receiving the supervisory frame with the A bit set to 1 shall respond, at the earliest opportunity, with an 
appropriate supervisory frame (see subclause 8.6.4. 1) to indicate whether or not its own receiver busy condition still 

exists. 

Upon receipt of the supervisory frame, the LLE shall reset timer T201, and: 

- if the frame is an RR, ACK or SACK frame: 

the peer receiver busy condition shall be cleared; 

if timer T201 was active before the peer receiver busy condition was set, and if the associated I frame is still 
not acknowledged, then timer T201 shall be set and associated with the same I frame; and 

the LLE may transmit new 1 frames or retransmit I frames as defined in subclauses 8.6.1 or 8.6.3, 
respectively; or 

if the frame is an RNR frame, then the LLE shall proceed according to subclause 8.6.4, first paragraph. 

Upon receipt of a S ABM command, the LLE shall clear the peer receiver busy condition. 

8.6.4.1 Supervisory frame selection 

If the LLE is in the own receiver busy condition, the appropriate supervisory frame is the RNR frame. 

Otherwise, if the highest-numbered I frame was received with N(S) = V(R), the appropriate supervisory frame is the RR 
frame. 

Otherwise, if the highest-numbered I frame was received with N(S) = V(R) + 1, the appropriate supervisory frame is the 
ACK frame. 

Otherwise, the appropriate supervisory frame is the SACK frame. 

8.6.5 Own receiver busy condition 

When the LLE enters the own receiver busy condition, it shall transmit an RNR frame at the earliest opportunity. 

All received I frames may be discarded, after updating V(A). If the A bit of a received I frame was set to 1, then the 
LLE shall transmit an RNR frame. 

All received supervisory frames shall be processed, including updating V(A). If the A bit of a received S frame was set 
to 1, then the LLE shall transmit an RNR frame. 

To indicate to the peer LLE the clearance of the own receiver busy condition, the LLE shall transmit an appropriate 
supervisory frame (see subclause 8.6.4.1). 

The transmission of a S ABM command or a UA response (in reply to a SABM command) also indicates to the peer 
LLE the clearance of the own receiver busy condition. 



8.6.6 Waiting for acl^nowledgement 



Frames may be lost any time during transmission due to e.g., transmission errors. An LLE that has not received 
acknowledgement for a transmitted I frame shall therefore on the expiry of timer T201 take appropriate recovery action. 
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The LLE shall maintain an internal retransmission count variable for each transmitted I frame. 

If timer T201 expires, the LLE shall increment by 1 the retransmission count variable for the I frame associated with 
timer T201, and: 

if the value of the retransmission count variable does not exceed N200, set timer T201, and retransmit the 
I frame with the A bit set to 1 ; or 

if the value of the retransmission count variable exceeds N200, initiate a re-establishment procedure as defined 
in subclause 8.7.2. LLME shall indicate this by means of the LLGMM-STATUS-IND primitive to GMM. 

8.7 Re-establishment of ABM operation 

8.7.1 Criteria for re-establisinment 

The criteria for re-establishing the ABM mode of operation are defined in this clause by the following conditions: 
- the receipt, while in the ABM state, of a S ABM; 

the receipt of an LL-ESTABLISH-REQ primitive from layer 3 (see subclause 8.5.1.1); 

the occurrence of N200 retransmission failures (see subclauses 8.6.4 and 8.6.6); 

the occurrence of a frame rejection condition as identified in subclause 8.8.2; and 

the receipt of an unsolicited DM response with the F bit set to (see subclause 8.8.4) while in ABM state. 

8.7.2 Procedures 

In all re-establishment situations, the LLE shall follow the procedures defined in subclause 8.5.1. All locally-generated 
conditions for re-establishment shall cause the transmission of the SABM. 

In the case of LLC layer and peer-initiated re-establishment, the LLE shall issue an LL-ESTABLISH-IND primitive to 
layer 3 and discard all outstanding LL-DATA-REQ primitives and all queued I frames, and LLME shall issue an 
LLGMM-STATUS-IND primitive to GMM. 

In case of layer 3-initiated re-establishment, or if an LL-ESTABLISH-REQ primitive occurs pending re-establishment, 
the LL-ESTABLISH-CNF primitive shall be used. 



Layer 3 



Originator 



LLC 



LL-ESTABLISH-IND 

"^ 



LLC 



SABM 



UA 



Receiver 



Layer 3 



LL-ESTABLISH-IND 



Figure 21 : LLC-initiated ABM re-establishment procedure 



8.8 Exception condition reporting and recovery 

Exception conditions may occur as the result of lower layer errors or LLC layer procedural errors. 

The error recovery procedures available to effect recovery following the detection of an exception condition at the LLC 
layer are defined in this subclause. 

8.8.1 Invalid frame condition 

Any received invalid frame shall be discarded, and no action shall be taken as a result of that frame. 
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8.8.2 Frame rejection condition 

A frame rejection condition results from one of the conditions described in subclause 6.4.1.5 items 1) to 3). 

Upon occurrence of a frame rejection condition, the LLME shall issue an LLGMM-STATUS-IND primitive; and the 
LLE shall: 

discard the frame causing the frame rejection condition; 

transmit a FRMR response frame; and 

if the LLE is in ABM operation, initiate re-establishment (see subclause 8.7.2). 

8.8.3 Receipt of a FRMR response frame 

Upon receipt of a FRMR response frame, the LLME shall issue an LLGMM-STATUS-IND primitive. 

8.8.4 Unsolicited response frames 

The action to be taken on the receipt of an unsolicited response frame is defined in table 8. Upon the receipt of an 
unsolicited UA response, the LLE shall assume a possible multiple-TLLI assignment, and LLME shall inform GMM by 
means of the LLGMM-STATUS-IND primitive. 

Table 8: Actions taken on receipt of unsolicited response frames 



Unsolicited 


State 


Response 
Frame 


TLLI Assigned 
/ADM 


Local 
Establishment 


Local 
Release 


ABM 


Timer 
Recovery 


UA response 
F= 1 


LLGMM- 
STATUS-IND 


Solicited 


Solicited 


LLGMM-STATUS- 
IND 


LLGMM-STATUS- 
IND 


UA response 
F = 


LLGMM- 
STATUS-IND 


LLGMM- 
STATUS-IND 


LLGMM- 
STATUS-IND 


LLGMM-STATUS- 
IND 


LLGMM-STATUS- 
IND 


DM response 
F= 1 


Ignore 


Solicited 


Solicited 


LLGMM-STATUS- 
IND 


LLGMM-STATUS- 
IND 
Re-establish ABM 


DM response 
F = 


Ignore 


Ignore 


Ignore 


LLGMM-STATUS- 
IND 
Re-establish ABM 


LLGMM-STATUS- 
IND 
Re-establish ABM 


Supervisory 
response 


Ignore 


Ignore 


Ignore 


Solicited 


Solicited 



A UA or XID response frame with the F bit set to 1, and that does not contain a Layer-3 Parameters XID parameter, 
received while a SABM or XID command respectively that does contain a Layer-3 Parameters XID parameter is 
outstanding, shall be ignored. 

A UA or XID response frame with the F bit set to 1, and that contains a Layer-3 Parameters XID parameter, received 
while a SABM or XID command respectively that does not contain a Layer-3 Parameters XID parameter is outstanding 
shall be ignored. 



8.9 List of LLC layer parameters 



The LLC layer parameters listed in this subclause are associated with each DLCI, except the LLC version number and 
lOV-UI that are associated with a TLLI. 

A method of assigning these parameters is defined in subclauses 6.4.1.6 and 8.5.3. 

Table 9 provides an overview of the LLC layer parameters and summarises the recommended default values to be used 
in GSM networks. The term default implies that the value defined should be used in the absence of any negotiation of 
alternative values. 
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Some of the parameters, e.g., T200, T201, and N200, may have the same name as parameters used in other GSM 
specifications. All the parameters listed here are local to the LLC layer protocol, and shall not impact or be impacted by 
parameters with the same name in other specifications. 

8.9.1 LLC version number (Version) 

The LLC version number (Version) is an LLC layer parameter. The default version number is given in table 9. 

8.9.2 Input Offset Value (lOV) 

The Input Offset Value (lOV) is an LLC layer parameter used for ciphering. lOV is a random 32 bit value, generated by 
the SGSN. See also annex A. 

The value for lOV can be different for I frames and UI frames. lOV-UI is lOV for UI frames. lOV-I is lOV for 
I frames. 

The default values of lOV are given in table 9. The following rules apply to lOV values: 

After a change of ciphering key to a different value a random lOV-I value shall be negotiated. If ABM is re- 
established for an LLE, and ciphering key is not changed to a different value since ABM was last 
(re-)established for this LLE, then a random lOV-I value shall be negotiated. 

After a change of ciphering key to a different value, a random lOV-UI value shall be negotiated. If the 
unconfirmed send state variable V(U) is reset for an LLE, and ciphering key is not changed to a different value 
since V(U) was last reset for this LLE, then a random lOV-UI value shall be negotiated. 

8.9.3 Retransmission timers (T200 and T201 ) 

The retransmission timers (T200 and T201) are LLC layer parameters. Upon expiry of timer T200 or T201, 
retransmission of a frame may be initiated according to the procedures described in clause 8. The default value of timers 
T200 and T201 for each SAPI is given in table 9. The value of timer T200 shall be used when setting timer T201. 

8.9.4 Maximum number of retransmissions (N200) 

The maximum number of retransmissions of a frame (N200) is an LLC layer parameter. The default value of N200 for 
each SAPI is given in table 9. 

8.9.5 Maximum number of octets in an information field (N201 ) 

The maximum number of octets in an information field (N201) is an LLC layer parameter. See also subclause 5.4. The 
default value of N201 for each SAPI is given in table 9. The minimum value of N201 shall be 140 octets, and the 
maximum value shall be 1 520 octets. 

The value of N201 may be different for I frames and U and UI frames. N201-U is used for U and UI frames, and 
N201-I is used for I frames. 

8.9.6 Maximum number of octets in the layer-3 header (N202) 

The maximum number of octets in the layer-3 unitdata PDU header (N202) is an LLC layer parameter. The N202 value 
shall be 4 for LLC version number 0. 

NOTE: The N202 value of 4 octets coincides with the maximum-length SNDCP SN-UNITD ATA PDU header. 

8.9.7 Maximum I frame buffer size (m) 

The maximum I frame buffer size (m) that may be used to buffer outstanding I frame information fields at any given 
time is an LLC layer parameter that shall be either or from 9 through 24 320 in units of 16 octets. The default values 
of m are given in table 9. If the value of m equals 0, then the LLE shall not keep count of the number of outstanding 
I frame octets, i.e. the I frame buffer variable B shall not be used. M is the maximum buffer size expressed in octets, so 
that M = m X 16. 
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The value of m can be different in each direction of transmission. mD is m in the downUnk direction, mil is m in the 
upHnk direction. 

8.9.8 Maximum number of outstanding I frames (W) 

The maximum number (k) of sequentially-numbered I frames that may be outstanding (i.e. unacknowledged) at any 
given time is an LLC layer parameter that shall not exceed 255. k is also denoted window size. The default values of k 
are given in table 9. 

The value of k can be different in each direction of transmission. kD is k in the downlink direction, and kU is k in the 
uphnk direction. 

8.9.9 LLC layer parameter default values 

Table 9: LLC layer parameter default values 



LLC 
Parameter 


SAPI1 
GMM 


SAPI2 
TOM 2 


SAPIS 

User 

Data 3 


SAPIS 

User 

Data 5 


SAPI 7 
SMS 


SAPIS 
TOMS 


SAPI 9 

User 

Data 9 


SAPI11 

User 

Data 11 


Version 





lOV-UI 





lOV-l 


Note 2 


Note 2 


2'" X SAP! 


2" X SAPI 


Note 2 


Note 2 


2'" X SAPI 


2" X SA 
PI 


1200 and 
1201 


5s 


5s 


5s 


10s 


20 s 


20 s 


20 s 


40 s 


N200 


3 


3 


3 


3 


3 


3 


3 


3 


N201-U 


400 


270 


500 


500 


270 


270 


500 


500 


N201-I 


Note 2 


Note 2 


1 503 


1 503 


Note 2 


Note 2 


1 503 


1 503 


mD 


Note 2 


Note 2 


1 520 


760 


Note 2 


Note 2 


380 


190 


mU 


Note 2 


Note 2 


1 520 


760 


Note 2 


Note 2 


380 


190 


kD 


Note 2 


Note 2 


16 


8 


Note 2 


Note 2 


4 


2 


kU 


Note 2 


Note 2 


16 


8 


Note 2 


Note 2 


4 


2 


1100 


3s 


3s 


3s 


3s 


3s 


3s 


3s 


3s 


NOTE 1 : Proper LLC operation requires that timer T200 be greater than the maximum time between transmission of 
command frames and the reception of their corresponding response or acknowledgement frames. 

NOTE 2: This parameter applies to ABM procedures. ABM operation is not allowed for GMM, SMS, and TOM that use 
only Ul frames for information transfer. 

NOTE 3: The default values for SAPIs 3, 5, 9, and 1 1 have been chosen to correspond with the four GPRS quality of 
service delay classes, see 3GPP TS 22.060 [3]. However, there is no fixed relationship between SAP! and 
delay class. The LLC layer parameters for any SAP! can be negotiated to support any QoS profile, see 
3GPP TS 23.060 [5]. 

NOTE 4: Proper LLC operation requires that the values for N201 -U and N201 -1 are not greater than the maximum 
number of octets in an information field that can be transmitted or retransmitted over the Gb interface, see 
3GPP TS 48.01 8 [1 2]. It is the responsibility of the SGSN to negotiate N201 -U and N201 -1 to values 
compatible with the usage of the Gb interface. 
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Annex A (normative): 
Ciphering 

A.1 General 

This annex specifies how LLC shall interface with the GPRS ciphering algorithm. The requirements for the GPRS 
ciphering algorithm are contained in 3GPP TS 4L061 [2] (for GEA algorithms which require 64-bit ciphering key or 
Kc), and in 3GPP TS 43.020 [27] (for GEA algorithms which require 128-bit ciphering key or Kc^s). 

A.2 Ciphering algorithm interface 

The ciphering algorithm has three input parameters: 

the ciphering key (Kc or Kci28); 

the frame-dependent input (Input); and 

the transfer direction (Direction). 
The ciphering algorithm has one output parameter: 

- Output. 
The relationship between the input and output parameters and the ciphering algorithm is illustrated in figure A. 1 . 



Ciphering Key 



Input 



Direction 



Ciphering Algorithm 



Ciphering Key 



Input 



Direction 



Ciphering Algorithm 



Unciphered 
Frame 



Output 




Ciphered 
Frame 



Output 



Deciphered 
Frame 



MS or SGSN 



SGSN or MS 



Figure A.1 : GPRS ciphering environment 

The input and output parameters and the other elements from figure A.1 are defined in table A.1. 
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Table A.I : Ciphering parameters and frames 



Parameter 


Length 


Description 


Kc 


64 bits 


The LLGIVIM-ASSIGN-REQ Ciphering Key parameter received from GMM. 


KC128 


128 bits 


The LLGMM-ASSIGN-REQ Ciphering Key parameter received from GIVIM. 


Input 


32 bits 


A modulo counter as defined in subclause A.2.1 . 


Direction 


1 bit 


Set to if the direction of LLC frame transmission is from the MS to the SGSN. 
Set to 1 if the direction of LLC frame transmission is from the SGSN to the IVIS. 


Ciphering 
Algorithm 


- 


A GPRS ciphering algorithm as determined by the LLGIVIM-ASSIGN-REQ Ciphering 
Algorithm parameter received from GMM. 


Output 


maximum 
1 523 octets 


The output of Ciphering Algorithm — a sequence of octets. 


Unciphered 
Frame 


maximum 
1 523 octets 


An LLC layer 1 or Ul frame to be ciphered. 


Ciphered 
Frame 


maximum 
1 523 octets 


A ciphered LLC layer 1 or Ul frame. Only the information field and the FCS field shall 
be ciphered. Ciphered Frame shall be generated by XORing the octets of Output 
and the Information Field and FCS Field of Unciphered Frame, starting with the 
lowest numbered octet of Unciphered Frame. 


Deciphered 
Frame 


maximum 
1 523 octets 


A deciphered LLC layer 1 or Ul frame. Deciphered Frame shall be generated by 
XORing the octets of Output and the ciphered part of Ciphered Frame, starting with 
the lowest numbered octet of Ciphered Frame. When transmitting an LLC frame. 
Deciphered Frame shall be identical to Unciphered Frame if no transmission errors 
have occurred. 



It is an implementation option to optimise the ciphering algorithm by for example producing only as many Output 
octets as is needed to cipher Unciphered Frame. 



A.2.1 Generation of Input 



The Input parameter shall be generated according to the following algorithm if the frame is a Ul frame: 

Input = ( ( lOV-UI ® SX ) H- LFN + OC ) modulo 2^^ 
The Input parameter shall be generated according to the following algorithm if the frame is an I frame: 



where: 



Input = ( lOV-I + LFN + OC ) modulo 2'^ 

lOV-UI is a 32 bit random value generated by the SGSN. 

lOV-I is a 32 bit random value generated by the SGSN. 

LFN is the LLC frame number in the LLC frame header. LFN is a binary value with a length of nine bits. For 
I frames, N(S) shall be used as the LFN. For Ul frames, N(U) shall be used as the LFN. 

OC is a binary overflow counter that is calculated and maintained independently at the sending and receiving 
sides. The length of OC is 32 bits. There are four OC counters associated with each DLCI; two for 
unacknowledged information transfer (one for each direction of transmission), and two for acknowledged 
information transfer (one for each direction of transmission). An OC for acknowledged operation shall be set 
to whenever ABM operation is (re-)established for the corresponding DLCI. OC shall be incremented by 512 
every time when the corresponding LFN rolls over, i.e., when LFN exhausts its modulo and restarts counting 
from 0, so that OC and LFN when added together in effect is a 32 bit modulo 2^^ counter. 

SX is a 32 bit SAPI XOR mask calculated as follows: SX = 2^^ x SAPI + 2^\ 

+ is the binary addition operation. 

(8) is the bitwise XOR operation. 
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Annex B (normative): 
Tunnelling of Messages (TOM) 



Tunnelling of Messages (TOM) is a generic protocol layer used for the exchange of TOM Protocol Envelopes (see 
figure B.l) between the MS and the SGSN. TOM uses two LLC SAPs, one for high-priority messages and another for 
low-priority messages. The TOM Protocol Envelope is composed of a TOM Protocol Header (containing one or more 
octets) and a Message Capsule. The TOM Protocol Header contains information about the specific application using the 
TOM protocol layer and any other TOM Protocol Discriminator-specific information. The Message Capsule is the 
actual payload of information in the TOM Protocol Envelope. One of the uses of the TOM protocol layer is to tunnel 
signalling messages between an MS and a non-GSM MSC/VLR when GPRS network elements are used in non-GSM 
networks. See 3GPP TS 23.060 [5] and 3GPP TS 29.018 [23a]. The TOM protocol layer is also used to tunnel Radio 
Resource LCS Protocol (RRLP) messages. See 3GPP TS 43.059[25] and 3GPP TS 44.031[24]. 



B.1 TOM Protocol Envelope structure 

All TOM protocol peer-to-peer exchanges shall be in TOM Protocol Envelopes conforming to the format shown in 
figure B.l. The TOM Protocol Header shall consist of the TOM Protocol Discriminator, Remaining Length of TOM 
Protocol Header, and Remaining Octets of TOM Protocol Header fields, and is a minimum of 1 octet and a maximum 
of 15 octets long. 



Remaining Length 

of TOIVI Protocol 

Header 



TOIVI Protocol 
Discriminator 



Remaining Octets of TOM Protocol 

Header 

(variable length, max. 14 octets) 



Message Capsule 
(variable length, max. application 

specific) 
(variable length, max. 220 octets) 



Figure B.l : TOM Protocol Envelope format 

NOTE: When the TOM Protocol Discriminator indicates TIA/EIA-136, the maximum size of the message 
capsule is 220 octets (see [22]). 

When the TOM Protocol Discriminator indicates RRLP, the maximum size of the message capsule is 242 
octets (see 3GPP TS 44.031 [24]). 

B.1.1 TOM Protocol Discriminator 

TOM Protocol Discriminator indicates the specific protocol using TOM, and is coded as follows: 

bits 4 3 2 1 

Not specified 

00 1 TIA/EIA-136 [22] 

10 RRLP [24] 

1111 Reserved for extension 

All other values are reserved 
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If any other value than '0 1' or '0 1 0' is received, then the TOM Protocol Envelope shall be discarded with no 
further action. 

B.1 .2 Remaining Length of TOIVI Protocol Header 

Remaining Length of TOM Protocol Header indicates the number of octets remaining in the TOM-protocol-header part 
of the TOM Protocol Envelope, and is coded as follows: 



bits 8 7 6 5 

octets remaining in TOIVI protocol header 

1 1 octet remaining in TOM protocol header 

1110 14 octets remaining in TOM protocol header 

1111 Reserved for extension 



If the value 1 1 1 1 is received, then the TOM Protocol Envelope shall be discarded with no further action. 

B.1 .3 Remaining Octets of TOIVI Protocol Header 

This field contains the octets following the first octet in the TOM-protocol-header. If present, the interpretation of the 
information contained in this field is TO M Protocol Discriminator-specific. 

B.1 .4 Message Capsule 

This field contains TOM Protocol Discriminator-specific pay load in the TOM Protocol Envelope. 
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Annex C (informative): 

LLC layer states for peer-to-peer operation 



C.1 General 



The purpose of this annex is to provide a representative example of the peer-to-peer procedures of the LLC layer, to 
assist in the understanding of the present document. This representation does not describe all of the possible actions of 
the LLC layer. The representation does therefore not constrain implementations from exploiting the full scope of the 
procedures as presented within the text of the present document. The text description of the procedures is normative. 

The representation is a model of the peer-to-peer procedures of the LLC layer and is applicable to the LLC layers at 
both the MS and SGSN sides for all ranges of TLLI values. 



Service user 
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Service user 
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LLC layer 



< 



Management 
procedures 



> 



< 



Point-to-point 
procedures 
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> 



Point-to-point 
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Management 
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Figure C.I : Model of the LLC layer peer-to-peer procedures 



C.2 An overview of the peer-to-peer LLC layer states 

The state diagram representation of the peer-to-peer procedures is based on an expansion of the three basic states 
identified in subclause 4.5.2 to 7 states. An overview of the inter-relationship of these states is provided in figure C.2. 

An LLME and its LLEs are conceptually initiated in the TLLI Unassigned state (state 1). LLME interacts with GMM in 
order to be assigned a TLLI value. TLLI assignment causes LLME to transition to the TLLI Assigned state (state 2) and 
each of its LLEs to transition to the ADM state (state 2). 

The receipt of an LL-ESTABLISH-REQ primitive by an LLE in the ADM state (state 2) causes the initiation of the 
local establishment procedure and the transition to the Local Establishment state (state 3). Completion of the 
establishment procedure takes the LLE to the ABM state (state 5). 

Peer-initiated establishment causes a transition from the ADM state (state 2) to the Remote Establishment state (state 4). 
The receipt of an LL-ESTABLISH-RES primitive completes the establishment procedure and moves the LLE to the 
ABM state (state 5). In ABM state (state 5), LL-DATA-REQ primitives can be serviced directly subject to the 
restrictions of the procedures. 

Expiry of timer T200, that is used in both the flow control and data transfer aspects of each LLE's procedures initiates 
the transition to the Timer Recovery state (state 7). Completion of the timer recovery procedures returns the LLE to the 
ABM state (state 5). In states 5 and 7, the following conditions that are identified within the LLC specification are 
observed: 

peer receiver busy; and 

own receiver busy. 

A peer-initiated release takes the LLE directly to the ADM state (state 2), whilst an LL-RELEASE-REQ returns the 
LLE state to the ADM state via the Local Release state (state 6). 

TLLI Unassignment causes a transition to the TLLI Unassigned state (state 1) from any other state (states 2-7). Reset 
causes a transition to the TLLI Assigned / ADM state (state 2) from any other state except state L 
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In addition, all states should observe the suspended operation (reception of LLGMM-SUSPEND-REQ) restrictions, 
during which LLC frames may not be transmitted. 
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Figure C.2: Overview of the states of the peer-to-peer procedures 
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